CVE-2026-30404: SSRF

Q: Who can exploit this issue?

The CVSS vector indicates network-based exploitation with low complexity, no privileges required, and no user interaction required. Systems exposing the affected wgcloud backend database management connection test feature are the relevant attack surface.

Q: What could an attacker do through the vulnerable feature?

An attacker can cause the server to send requests for internal-network probing. The issue may also be used to remotely download malicious files and perform other dangerous operations.

Q: How can I tell whether my deployment is affected?

The reported affected version is wgcloud v3.6.3. Check whether that version is deployed and whether the backend database management connection test feature is available or exposed to network-accessible users.

Published Mar 19, 2026

Updated

The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited to make the server send requests to probe the internal network, remotely download malicious files, and perform other dangerous operations.

Affected Software

2 affected components

wgcloud wgcloud=3.6.3

Wgstart Wgcloud<=3.6.3

Event History

Mar 19, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates network-based exploitation with low complexity, no privileges required, and no user interaction required. Systems exposing the affected wgcloud backend database management connection test feature are the relevant attack surface.

What could an attacker do through the vulnerable feature?

An attacker can cause the server to send requests for internal-network probing. The issue may also be used to remotely download malicious files and perform other dangerous operations.

How can I tell whether my deployment is affected?

The reported affected version is wgcloud v3.6.3. Check whether that version is deployed and whether the backend database management connection test feature is available or exposed to network-accessible users.

CVE-2026-30404: SSRF

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What could an attacker do through the vulnerable feature?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What could an attacker do through the vulnerable feature?

How can I tell whether my deployment is affected?