CVE-2026-91199: Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint
Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Reflyto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated and able to send a POST request to the /v1/misc/scrape endpoint. No user interaction is required, and the attack can be performed remotely.
What systems or data can the attacker reach?
The backend can be induced to request caller-supplied loopback, private, and link-local addresses, including cloud metadata services. The exposed result is limited to page titles and descriptions returned from those internal resources.
Are default URL restrictions effective against this endpoint?
No validation is performed for the supplied URL's scheme, host, or resolved address. As a result, requests are not restricted from targeting internal or link-local network locations.
How can I determine whether my deployment is affected?
Deployments of Refly through version 1.1.0 are affected if authenticated users can access POST /v1/misc/scrape. Review whether the endpoint accepts user-controlled URLs and whether it can reach loopback, private, link-local, or cloud metadata addresses from the server environment.