CVE-2026-123201: buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Published Nov 5, 2026

Updated

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetchdata or /api/networkhandle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak isbadurl() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

Event History

Nov 5, 2026

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Any reachable bukuserver instance through version 5.1.1 is exposed because the affected endpoints are unauthenticated. Systems where an attacker can send requests to /api/fetch_data or /api/network_handle are at risk.

What does an attacker need to exploit this issue?

An attacker only needs network access to the bukuserver API and the ability to supply a url parameter to either affected endpoint. No authentication or user interaction is required.

What internal resources can be targeted?

The weak URL validation allows requests to loopback, private-network, and cloud metadata IP addresses, and redirects are followed. The exposed response data can reveal page titles, descriptions, and keywords from reachable internal services.

What can be done if an update cannot be applied immediately?

Restrict network access to bukuserver so untrusted users cannot reach the affected API endpoints. Network controls should also prevent the service from connecting to loopback, private-address ranges, and cloud metadata services where possible.

CVE-2026-123201: buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What internal resources can be targeted?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What internal resources can be targeted?

What can be done if an update cannot be applied immediately?