CVE-2026-82285CWE-918ssrf

CVE-2026-82285

High · published August 29, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00544 · 44.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-29T00:20Z
References (5)
https://github.com/dataelement/bisheng · [email protected]https://github.com/dataelement/bisheng/blob/3f27641987c7363d2d7b7b1a8c3c3dbe09c60fd7/src/backend/bisheng/api/v1/workflow.py · [email protected]https://github.com/dataelement/bisheng/issues/2190 · [email protected]https://www.vulncheck.com/advisories/bisheng-unauthenticated-server-side-request-forgery-via-workflow-report-callback · [email protected]https://github.com/dataelement/bisheng/issues/2190 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:19Z
    BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback
    cvelistv5