CVE-2026-72566 in automatisch
Summary
by MITRE • 08/10/2026
A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action. The packages/backend/src/apps/http-request/actions/custom-request/index.js handler passes the user-supplied URL directly to the HTTP client with no SSRF controls, enabling access to internal services and metadata endpoints.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability under discussion represents a critical server-side request forgery flaw within the automatisch platform that stems from insufficient input validation in the HTTP Request app's Custom Request action. This security weakness enables a low-privileged authenticated user who possesses the 'manage Flow' permission to craft malicious requests that can trick the server into fetching arbitrary URLs on behalf of the application. The vulnerability manifests specifically within the packages/backend/src/apps/http-request/actions/custom-request/index.js handler where user-supplied URL parameters are passed directly to the underlying HTTP client without any form of validation or sanitization measures. This architectural oversight creates a pathway for attackers to exploit the system's trust relationship with its own internal services and external endpoints.
The technical implementation of this vulnerability aligns with CWE-918, which classifies server-side request forgery as a security weakness where an application fails to properly validate or sanitize user-supplied URLs before making HTTP requests. The flaw operates at the intersection of insecure input handling and improper access control, as the system does not adequately distinguish between legitimate external endpoints and potentially harmful internal services. The absence of any SSRF controls means that authenticated users can leverage this functionality to access internal metadata endpoints such as AWS instance metadata services, internal APIs, or other sensitive systems that should normally be isolated from external access. This creates a significant risk exposure where attackers can potentially exfiltrate sensitive information or gain unauthorized access to internal resources that are typically protected by network segmentation and access controls.
The operational impact of this vulnerability extends beyond simple data leakage as it fundamentally undermines the security boundaries of the automatisch platform. An attacker with 'manage Flow' permissions can utilize this flaw to perform reconnaissance activities, identify internal services, and potentially escalate their access privileges within the system. The vulnerability enables access to metadata endpoints that often contain sensitive information such as API keys, database credentials, or other authentication tokens that could be used to compromise additional systems. This type of attack vector falls under ATT&CK technique T1071.004 for application layer protocol and T1566 for credential access, where the attacker leverages legitimate application functionality to gain unauthorized access to internal resources. The consequences are particularly severe because the vulnerability requires minimal privileges to exploit, making it accessible to users who should not have the ability to access internal network resources.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term architectural improvements. The primary fix involves implementing robust input validation and URL sanitization within the HTTP Request app's Custom Request action handler, ensuring that user-supplied URLs are properly validated against a whitelist of acceptable domains or patterns. Organizations should implement network-level restrictions to prevent internal services from being accessible through external-facing applications, utilizing firewalls and access control lists to isolate sensitive endpoints. Additionally, implementing proper authentication and authorization checks at the HTTP client level can help prevent unauthorized access to internal resources even if URL validation fails. The solution should also include monitoring and logging of all HTTP requests made through the system to detect anomalous behavior patterns that might indicate exploitation attempts. Regular security assessments and code reviews focusing on input handling and external service interactions are essential to prevent similar vulnerabilities from emerging in other parts of the application architecture, following established security frameworks such as those defined by the OWASP Top Ten and NIST cybersecurity guidelines.