CVE-2026-100391: MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation
MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destination validation in the d query parameter. Remote attackers can supply arbitrary internal URLs including loopback and cloud metadata endpoints to read full responses from the proxy server.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerable /proxy routes can be exploited remotely without authentication or user interaction. An attacker needs to submit a request with a crafted d query parameter containing a destination URL.
What systems or data could be exposed through exploitation?
The proxy can be induced to request arbitrary internal URLs, including loopback services and cloud metadata endpoints. The attacker can read the full response returned to the proxy server.
Are default deployments affected?
The available information identifies missing and incomplete destination validation in the /proxy routes, but does not state whether those routes are enabled or reachable in a default deployment.
How can I determine whether my deployment is affected?
Deployments of MediaFlow Proxy through version 2.4.9 should review whether their /proxy routes accept the d query parameter and whether destination URLs are restricted. Affected behavior is present when a remote request can cause the proxy to fetch internal or loopback URLs and return their responses.