CVE-2026-87821: Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch
Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint that allows any authenticated user to fetch arbitrary URLs and read the response body. Attackers can read internal HTTP services and cloud metadata including IAM credentials by supplying malicious URLs without host validation or redirect restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lara Dashboardto a version that resolves this vulnerability.Fixed in 1.3.1 - Configuration
Modify the POST /api/admin/builder/markdown/fetch behavior to validate the supplied URL host against an allowlist and prevent redirects to internal services or metadata endpoints.
Lara Dashboard /api/admin/builder/markdown/fetch host validation and redirect restrictions = enable strict host validation and disallow redirects to untrusted/internal destinations - Compensating control
Restrict network access from the application so the server running Lara Dashboard cannot reach internal HTTP services or cloud metadata endpoints (including IAM credential metadata).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Lara Dashboard user can exploit it. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What can an attacker access through the vulnerable endpoint?
An attacker can cause the server to fetch arbitrary URLs and read the response body. This can expose internal HTTP services and cloud metadata, including IAM credentials.
What URL protections are missing?
The endpoint does not enforce host validation or redirect restrictions. A supplied URL can therefore target internal resources or redirect to them.