CVE-2026-85691: MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any deployment of MegaParse 0.0.55 where the POST /v1/url endpoint is reachable by an attacker is exposed. The endpoint does not require authentication.
What does an attacker need to exploit it?
An attacker only needs network access to the POST /v1/url endpoint and the ability to provide a URL. No credentials or user interaction are required.
What can an attacker access through the vulnerable endpoint?
The attacker can cause MegaParse to fetch caller-supplied internal service URLs or metadata endpoints. The fetched response is returned directly in the JSON response, which can expose readable internal resources.
How can I determine whether a deployment is affected?
Verify whether the deployment is running MegaParse 0.0.55 and exposes POST /v1/url. Affected behavior is present when that endpoint fetches a supplied URL server-side and returns its response without requiring authentication.