CVE-2026-11346: Server-Side Request Forgery (SSRF) allowing Internal Network Probing in linqi
A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticated attacker to probe internal network components. By crafting a specific process containing an HTTP Request component, an attacker can force the server to send arbitrary HTTP requests. By observing the varying application responses (Success, Failed, or 504 Gateway Time-out), the attacker can determine the status of internal ports, leading to internal network reconnaissance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
linqi HTTP Request componentfrom your environment.Remove or uninstall the HTTP Request component from linqi if it is not required, preventing processes from performing outbound HTTP requests.
- Configuration
Disable the custom process creation feature in linqi to prevent creation of processes that can include an HTTP Request component.
linqi custom_process_creation_enabled = false - Configuration
Disable the HTTP Request component in linqi so created processes cannot issue arbitrary HTTP requests.
linqi http_request_component_enabled = false - Configuration
Restrict the ability to create custom processes to a small set of trusted administrative accounts only.
linqi custom_process_creation_permission = administrators_only - Compensating control
Block or restrict outbound HTTP(S) requests from the linqi application server to internal network address ranges and sensitive services at the network perimeter/firewall to prevent SSRF-based internal reconnaissance.
- Compensating control
Segment/isolate the application server from sensitive internal infrastructure and block access to internal ports to reduce impact of any SSRF exploitation.
- Operational
Audit recent custom process creations and any use of the HTTP Request component for indications of exploitation; remove or remediate any suspicious processes and accounts that performed them.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11346?
CVE-2026-11346 has a medium severity rating of 5.3 according to CVSS.
How do I fix CVE-2026-11346?
Fixing CVE-2026-11346 involves updating Linqi to the latest version which addresses the SSRF vulnerability.
What type of vulnerability is CVE-2026-11346?
CVE-2026-11346 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What impact does CVE-2026-11346 have?
CVE-2026-11346 allows authenticated attackers to probe internal network components, potentially leading to unauthorized access.
Who is affected by CVE-2026-11346?
Users of Linqi who utilize the custom process creation feature are affected by CVE-2026-11346.