CVE-2026-116069: NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker that can reach the NiubiGEO POST /audit-plan endpoint can exploit it; authentication is not required.
What requests can an attacker induce the server to make?
An attacker can supply IP literals, localhost, private-network hosts, or link-local hosts in the domain field. This can cause the server to fetch loopback services, internal-network resources, or cloud metadata endpoints.
What information may be exposed?
Responses fetched by the server may be returned in the plan's siteEvidence JSON. This can expose content available from internal, loopback, or cloud metadata services reachable by the NiubiGEO server.
Which versions are affected?
NiubiGEO versions before 0.3.2 are affected.