CVE-2026-2532CWE-918

lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery

Medium · published February 16, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.0.4 and 3.1.0 is capable of addressing this issue. The patch is named da853fdd8cbe9d42053b45d83f25708ba29b8b27. It is suggested to upgrade the affected component.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-02-16T03:02Z
EPSS history
Timeline
  • 16 FEB 03:02Z
    lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery
    cvelistv5