CVE-2026-8712: Wyoming < 1.10.2 SSRF via uri Query Parameter
Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious uri query parameter to the HTTP API. Attackers can pass arbitrary tcp:// or unix:// URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend and redirect connections to attacker-chosen hosts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wyomingto a version that resolves this vulnerability.Fixed in 1.10.2 - Compensating control
As a compensating control until Wyoming is upgraded, restrict network access to the HTTP API endpoints (/api/info, /api/speech-to-text, /api/text-to-speech) so unauthenticated attackers cannot supply a malicious `uri` query parameter.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated attacker with network access to the Wyoming HTTP API can exploit it. No privileges or user interaction are required.
Which interfaces are affected?
Affected endpoints include /api/info, /api/speech-to-text, and /api/text-to-speech. The attacker supplies a malicious uri query parameter to replace the configured backend connection target.
What outbound targets can an attacker make the server contact?
The disclosed attack supports arbitrary tcp:// and unix:// URIs. This can redirect the server to attacker-chosen network hosts or Unix-domain sockets.
What version addresses the issue?
Wyoming 1.10.2 addresses the vulnerability. Versions before 1.10.2 are affected.