CVE-2026-121561: Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads

Published Nov 3, 2026

Updated

Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Label Studio user can exploit it. The attack requires the ability to import tasks that set data.image and to export data in YOLO or COCO formats with images included.

What access can an attacker gain through exploitation?

The attacker can cause the server to request internal URLs and read their responses through image-bearing exports. By spoofing the Host header, they may also capture the organization owner's API token.

Are installations using the affected components exposed by default?

Exposure depends on whether authenticated users can import image-referencing tasks and perform YOLO or COCO exports with images. The provided information does not identify any additional configuration required for the vulnerable request behavior.

What versions should be updated?

Update Label Studio to 1.23.2 or later and label-studio-sdk to 2.1.2 or later. Versions before those releases are affected.

CVE-2026-121561: Label Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain through exploitation?

Are installations using the affected components exposed by default?

What versions should be updated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker gain through exploitation?

Are installations using the affected components exposed by default?

What versions should be updated?