CVE-2026-85179 in Label Studio
Summary
by MITRE • 09/03/2026
Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in Label Studio versions through 1.23.0 represents a critical server-side request forgery flaw rooted in insufficient input validation of webhook configuration parameters. Webhook functionality is commonly employed to notify external systems about events, such as the completion of data annotation tasks within machine learning workflows. In this specific implementation, the application fails to enforce strict allow-listing or protocol restrictions on the target URLs provided by authenticated users during webhook creation. This oversight allows an attacker who has obtained valid credentials for a Label Studio instance to specify arbitrary destination addresses rather than being restricted to legitimate external endpoints. The absence of validation mechanisms means that the server will blindly accept and process any URL string submitted in the configuration payload, regardless of whether it points to public internet resources or private infrastructure components.
The operational impact of this flaw is severe due to its potential for internal network reconnaissance and data exfiltration. By crafting webhook requests with targets set to RFC 1918 addresses, an attacker can direct outbound HTTP traffic from the Label Studio server into isolated internal networks that are typically shielded by firewalls or perimeter defenses. This capability effectively bypasses traditional network segmentation strategies because the request originates from a trusted application host rather than an external source. Furthermore, the vulnerability extends to cloud metadata endpoints, such as those found in AWS EC2 instance metadata service (IMDS) or Azure managed identity endpoints. Accessing these services can allow an attacker to retrieve temporary security credentials, access keys, and other sensitive configuration details associated with the underlying infrastructure hosting Label Studio. This escalation path transforms a simple application-level misconfiguration into a significant compromise of cloud environment integrity.
The risk is further amplified by the ability to enable payload transmission in outbound requests. When this feature is active, not only does the server send a notification trigger to the malicious target, but it also includes the body content associated with the webhook event. In the context of Label Studio, these payloads often contain sensitive annotation data, including labeled images, text classifications, or bounding box coordinates that represent valuable intellectual property or personally identifiable information depending on the dataset being processed. Consequently, an attacker can construct a workflow where they trigger specific events to force the server to exfiltrate this proprietary data directly to their controlled external infrastructure. This combination of unauthorized internal access and sensitive data leakage creates a high-severity security incident that undermines both confidentiality and integrity guarantees for organizations relying on Label Studio for model training pipelines.
Mitigation strategies must address both immediate remediation and long-term architectural hardening. The most effective solution is to upgrade the Label Studio installation to version 1.23.1 or later, where developers have implemented proper validation logic to restrict webhook targets to approved domains or protocols. For environments that cannot immediately patch due to operational constraints, network-level controls should be enforced. This includes configuring outbound firewall rules to block traffic from the application server to private IP ranges and cloud metadata endpoints unless explicitly required for business functions. Additionally, implementing egress filtering with deep packet inspection can help detect and prevent anomalous outbound connections originating from web applications. Organizations must also enforce strict access control policies around webhook configuration settings, ensuring that only authorized administrators have permission to modify these critical integration points within the application interface.