CVE-2026-82285: BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bishengto a version that resolves this vulnerability.Fixed in 2.6.0-fix2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any BISHENG instance through 2.6.0-fix2 where the POST /api/v1/workflow/report/callback endpoint is reachable by an attacker is exposed. The endpoint does not require authentication.
What does an attacker need to exploit it?
An attacker only needs network access to the callback endpoint and the ability to submit a POST request containing a target URL. No credentials or user interaction are required.
What resources can be targeted?
Because there are no URL scheme restrictions or host filters, an attacker can provide arbitrary URLs. This can be used to probe internal network services and cloud metadata endpoints from the BISHENG server's network position.
Can an attacker obtain the responses from requests they trigger?
Yes. Captured responses can be retrieved from object storage using object names supplied by the caller.