CVE-2026-72552 in Dub
要約
〜によって MITRE • 2026年08月11日
A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.