VYPR
← All advisories
Medium severityNVD Advisory· Published May 28, 2026

CVE-2026-9813

CVE-2026-9813

Description

FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server's network context.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

FlowIntel ≤3.3.0 contains an SSRF in the external reference URL probe, allowing attackers to make the server issue HTTP HEAD requests to internal or restricted networks.

Vulnerability

FlowIntel versions up to and including 3.3.0 contain a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality located in app/case/task.py. The function _probe_external_url accepts a user-supplied URL and issues an HTTP HEAD request via requests.head() without sufficient validation of the URL scheme or the resolved IP address. This allows an attacker who can submit an external reference URL to cause the application server to send requests to arbitrary destinations, including loopback (127.0.0.1), link-local, private, reserved, or other restricted network resources. The fix commit [1] adds validation for allowed schemes (http/https only), checks for a hostname, resolves the hostname to IP addresses, and rejects requests that resolve to private, loopback, link-local, multicast, reserved, or unspecified addresses.

Exploitation

An attacker must have the ability to submit an external reference URL within the FlowIntel application (e.g., through a case or task interface). No authentication is explicitly mentioned, but the functionality is likely available to authenticated users. The attacker provides a URL pointing to an internal service (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://127.0.0.1:8080/admin) or a restricted network address. The server then makes an HTTP HEAD request to that destination, potentially leaking information or allowing interaction with internal services. The attacker does not need to control the server's network; the request originates from the server's network context.

Impact

Successful exploitation allows the attacker to probe internal services, cloud metadata endpoints, or other restricted resources from the server's network. This can lead to information disclosure (e.g., cloud instance metadata, internal service banners) and potentially further attacks such as port scanning or accessing internal administrative interfaces. The impact is limited to the server's network context and the HTTP HEAD method, but may still expose sensitive information or enable lateral movement.

Mitigation

The vulnerability is fixed in commit [1] (68b523b) which introduces validation of URL scheme, hostname, and IP address restrictions. The fix is included in versions after 3.3.0. Users should upgrade to a patched version or apply the commit manually. No workaround is provided in the references. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.

References
  1. Mitigate SSRF in external reference URL probe · flowintel/flowintel@68b523b

AI Insight generated on May 28, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

1
68b523b47854

Mitigate SSRF in external reference URL probe

https://github.com/flowintel/flowintelAlexandre DulaunoyMay 28, 2026via nvd-ref
commit
1 file changed · +32 −0
  • app/case/task.py+32 −0 modified
    @@ -1,11 +1,14 @@
 import ast
+import ipaddress
 import os
+import socket
 import uuid
 
 import requests
 
 from datetime import datetime
 from flask import Blueprint, render_template, redirect, jsonify, request, flash, current_app
+from urllib.parse import urlparse
 
 from app.db_class.db import Case, User, db, Note
 
@@ -932,6 +935,35 @@ def delete_external_reference(cid, tid, erid):
 
 def _probe_external_url(url):
     """Probe a URL to detect common connection failures before invoking misp-modules."""
+    try:
+        parsed_url = urlparse(url)
+    except ValueError:
+        return "The URL is not valid"
+
+    if parsed_url.scheme not in ["http", "https"]:
+        return "Only http:// and https:// URLs are allowed"
+
+    if not parsed_url.hostname:
+        return "The URL is missing a hostname"
+
+    try:
+        addrinfo = socket.getaddrinfo(parsed_url.hostname, None)
+    except socket.gaierror:
+        return "The host likely doesn't exist (DNS resolution failed)"
+
+    for result in addrinfo:
+        ip = result[4][0]
+        parsed_ip = ipaddress.ip_address(ip)
+        if (
+            parsed_ip.is_private
+            or parsed_ip.is_loopback
+            or parsed_ip.is_link_local
+            or parsed_ip.is_multicast
+            or parsed_ip.is_reserved
+            or parsed_ip.is_unspecified
+        ):
+            return "The URL resolves to a restricted network address"
+
     try:
         requests.head(url, timeout=10, allow_redirects=True)
     except requests.exceptions.ConnectionError as e:

Vulnerability mechanics

Root cause

"Missing validation of URL scheme and resolved IP address before issuing an HTTP HEAD request allows SSRF."

Attack vector

An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination [ref_id=1]. Because the original code performed no validation of the URL scheme or resolved destination address, the attacker could supply a URL pointing to loopback (127.0.0.1), link-local, private (RFC 1918), multicast, reserved, or unspecified addresses. This enables interaction with internal services or cloud metadata endpoints from the server's network context, constituting a server-side request forgery (SSRF) vulnerability.

Affected code

The vulnerability resides in the `_probe_external_url` function within `app/case/task.py` [patch_id=2897467]. This function is called when a user submits an external reference URL, and it issues an HTTP HEAD request via `requests.head(url, timeout=10, allow_redirects=True)` without first validating the URL scheme or the resolved IP address [ref_id=1].

What the fix does

The patch adds validation at the start of `_probe_external_url` [patch_id=2897467]. It parses the URL with `urlparse`, restricts the scheme to `http` or `https`, ensures a hostname is present, resolves the hostname with `socket.getaddrinfo`, and checks each resolved IP against `ipaddress` properties including `is_private`, `is_loopback`, `is_link_local`, `is_multicast`, `is_reserved`, and `is_unspecified`. If any check fails, the function returns an error message before the `requests.head` call is ever made, closing the SSRF vector [ref_id=1].

Preconditions

  • inputThe attacker must be able to submit an external reference URL to the FlowIntel application.
  • configThe application must be running a version up to 3.3.0 (unpatched).

Generated on May 28, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

1

News mentions

0

No linked articles in our index yet.