CVE-2026-92795CWE-918ssrf

CVE-2026-92795

Medium · published September 17, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-17T01:17Z
References (5)
https://github.com/coze-dev/coze-studio · [email protected]https://github.com/coze-dev/coze-studio/blob/22275b1c2661d35344a7493cffe401e8cc61cf8e/backend/domain/plugin/service/tool/invocation_http.go#L127-L146 · [email protected]https://github.com/coze-dev/coze-studio/issues/2711 · [email protected]https://www.vulncheck.com/advisories/coze-studio-through-0.5.1-server-side-request-forgery-via-plugin · [email protected]https://github.com/coze-dev/coze-studio/issues/2711 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin
    cvelistv5