CVE-2026-111313: JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can exploit the affected endpoint. If JobOps is running in demo mode, unauthenticated clients can also exploit it.
What access can an attacker gain through the vulnerable request?
An attacker can cause the JobOps server to fetch loopback, private-network, or cloud metadata addresses supplied in the url field. The returned page content may expose cloud instance metadata and data from internal services.
What should be checked to determine exposure?
Check whether the deployment runs JobOps through version 0.13.1 and whether POST /api/manual-jobs/fetch is reachable by authenticated users or exposed without authentication through demo mode. Review requests to that endpoint for url values targeting loopback, private, or cloud metadata addresses.