Medium severity6.5NVD Advisory· Published Sep 16, 2026

CVE-2026-92795

Description

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.

Affected products

Coze/Coze Studioreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=0.5.1

Patches

Vulnerability mechanics

References

github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/plugin/service/tool/invocation_http.gonvd
github.com/coze-dev/coze-studio/issues/2711nvd
www.vulncheck.com/advisories/coze-studio-through-0.5.1-server-side-request-forgery-via-pluginnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000