CVE-2026-85179CWE-918ssrf

CVE-2026-85179

High · published September 3, 2026

CVSS v3.1
8.5
EPSS
0%
Percentile
33.2
In the wild
Unconfirmed
What it is

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00401 · 33.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-03T19:17Z
References (5)
https://github.com/HumanSignal/label-studio · [email protected]https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/webhooks/utils.py · [email protected]https://github.com/HumanSignal/label-studio/commit/2c1c1d6472153032af8ed399168f814bea854e3e · [email protected]https://github.com/HumanSignal/label-studio/issues/9801 · [email protected]https://www.vulncheck.com/advisories/label-studio-through-1.23.0-ssrf-via-unvalidated-webhook-url · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 14:12Z
    Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL
    cvelistv5