CVE-2026-8712 in Wyoming
Summary
by MITRE • 09/01/2026
Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers can pass arbitrary `tcp://` or `unix://` URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend and redirect connections to attacker-chosen hosts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified in Wyoming versions prior to 1.10.2 represents a critical Server-Side Request Forgery (SSRF) flaw within its HTTP API implementation. This security defect allows unauthenticated attackers who possess network access to the service to manipulate outbound connections initiated by the server itself. By injecting malicious payloads into specific query parameters, specifically targeting the uri parameter, an attacker can force the Wyoming application to establish connections with arbitrary external targets chosen by the adversary rather than the intended backend services configured for speech processing tasks.
The technical root cause of this vulnerability lies in insufficient input validation and sanitization mechanisms within the API endpoints responsible for handling audio processing requests. The affected endpoints include /api/info, /api/speech-to-text, and /api/text-to-speech. When a request is received containing a specially crafted uri parameter, the application fails to restrict the protocol schemes or destination hosts allowed in the connection string. This lack of validation permits the injection of non-standard URI schemes such as tcp:// or unix://, which are typically reserved for internal communication protocols and local socket connections rather than standard HTTP-based web requests.
The operational impact of this vulnerability is severe due to its unauthenticated nature and broad scope across core functionality endpoints. An attacker can leverage this flaw to perform network reconnaissance by probing internal services that may not be directly accessible from the external network, such as database servers, administrative interfaces, or other microservices running on localhost or within a private subnet. Furthermore, because the vulnerability supports unix:// URIs, it potentially enables local file read attacks if the underlying implementation allows interaction with Unix domain sockets for reading sensitive files from the host filesystem. This capability transforms what might appear to be a simple misconfiguration into a potent tool for data exfiltration and lateral movement within compromised environments.
From an industry standard perspective, this vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery as a flaw where a web server retrieves a specified resource from a user-supplied URL without proper validation of the destination. Additionally, in terms of tactical classification under the MITRE ATT&CK framework, this behavior corresponds to T1571, Non-Standard Port Communication, and potentially T1046, Network Service Discovery, as attackers use the server's outbound capabilities to map internal network topologies and identify vulnerable services for further exploitation.
To mitigate this risk, organizations running Wyoming must immediately upgrade to version 1.10.2 or later where these input validation checks have been implemented. In scenarios where an immediate patch is not feasible, defensive measures should include implementing strict allowlists for outbound connections at the network perimeter using firewalls or proxy servers that block requests to private IP ranges and non-standard ports. Additionally, application-level mitigations involve enforcing rigorous URL parsing logic that rejects any URI scheme other than http:// and https://, ensuring that only standard web protocols are permitted for backend communication. Regular security audits of API endpoints should also be conducted to detect similar input validation weaknesses in related services.