CVE-2026-36756: SSRF
Published Apr 30, 2026
·Updated
A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafted GET request.
Affected Software
1 affected component
Halo Halo=2.22.14
Event History
Apr 30, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-36756?
The severity of CVE-2026-36756 is classified as high due to its potential to allow authenticated attackers to access internal resources.
2
How do I fix CVE-2026-36756?
To fix CVE-2026-36756, upgrade Halo to version 2.22.15 or later, where the vulnerability is patched.
3
Who is affected by CVE-2026-36756?
CVE-2026-36756 affects users of Halo version 2.22.14 who have authenticated access to the system.
4
What type of vulnerability is CVE-2026-36756?
CVE-2026-36756 is a Server-Side Request Forgery (SSRF) vulnerability.
5
Can CVE-2026-36756 be exploited remotely?
Exploitation of CVE-2026-36756 requires authenticated access, but it allows attackers to scan internal resources, potentially leading to further attacks.