CVE-2026-116280: Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery

Q: Which deployments are affected?

Kameleo versions up to and including 5.0.1.26 are affected in the Proxy Validation component's InternalController.TestProxy function.

Q: What does an attacker need to exploit this issue?

The attack can be launched remotely and requires manipulation of the host/port argument used by proxy validation. The supplied severity vector indicates low privileges and user interaction are required.

Q: What is the recommended remediation?

Upgrade Kameleo to version 5.2.0. In that version, the affected route was removed and replaced with /general/test-proxy.

Published Oct 26, 2026

Updated

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may be launched remotely. Upgrading to version 5.2.0 is able to address this issue. It is suggested to upgrade the affected component. The route has been removed and replaced with /general/test-proxy in 5.2.0.

Affected Software

1 affected component

Kameleo Kameleo<=5.0.1.26

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kameleo to a version that resolves this vulnerability.
Fixed in 5.2.0

Event History

Oct 26, 2026

CVE Published

via MITRE·12:45 PM

Data Sourced

via MITRE·12:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Kameleo versions up to and including 5.0.1.26 are affected in the Proxy Validation component's InternalController.TestProxy function.

What does an attacker need to exploit this issue?

The attack can be launched remotely and requires manipulation of the host/port argument used by proxy validation. The supplied severity vector indicates low privileges and user interaction are required.

What is the recommended remediation?

Upgrade Kameleo to version 5.2.0. In that version, the affected route was removed and replaced with /general/test-proxy.

CVE-2026-116280: Kameleo Proxy Validation f.cs InternalController.TestProxy server-side request forgery

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the recommended remediation?