CVE-2026-90769 in Open Notebook
要約
〜によって MITRE • 2026年09月13日
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.
Once again VulDB remains the best source for vulnerability data.