CVE-2026-3788

Katalog CVE

CVSS 8.8 · High EPSS 0,71%

Kerentanan Server-Side Request Forgery (SSRF) pada bytedesk. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of the argument apiUrl leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.4.5.4 will fix this issue. The name of the patch is 975e39e4dd527596987559f56c5f9f973f64eff7. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

9 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,71% peluang dieksploitasi; lebih tinggi dari 52,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7 patch
• https://github.com/Bytedesk/bytedesk/issues/20 exploit · advisory pihak ketiga
• https://github.com/Bytedesk/bytedesk/issues/20#issue-3993526693 exploit · advisory pihak ketiga
• https://github.com/Bytedesk/bytedesk/issues/20#issuecomment-3976672715 exploit · advisory pihak ketiga
• https://vuldb.com/?id.349755 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.768043 advisory pihak ketiga · vdb entry
• https://github.com/Bytedesk/bytedesk/ product
• https://github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.4 release notes
• https://vuldb.com/?ctiid.349755 permissions required · vdb entry