CVE-2026-102879CWE-918ssrf

CVE-2026-102879

Medium · published September 30, 2026

CVSS v3.1
5.0
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata endpoints.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00233 · 13.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-30T00:17Z
References (5)
https://github.com/claraverse-space/ClaraVerse · [email protected]https://github.com/claraverse-space/ClaraVerse/blob/v0.3.1/backend/internal/security/ssrf.go · [email protected]https://github.com/claraverse-space/ClaraVerse/blob/v0.3.1/backend/internal/tools/download_file_tool.go · [email protected]https://github.com/claraverse-space/ClaraVerse/issues/254 · [email protected]https://www.vulncheck.com/advisories/claraverse-through-0.3.1-ssrf-protection-bypass · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 20:01Z
    ClaraVerse through 0.3.1 SSRF Protection Bypass
    cvelistv5