CVE-2026-92566: DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to internal endpoints and cloud metadata services, receiving full response bodies without authentication or validation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DataGearto a version that resolves this vulnerability.Fixed in 6.0.0 - Compensating control
Block or restrict network access to the DataGear endpoint /dataSet/preview/Http and internal/cloud metadata services so unauthenticated requests cannot reach those destinations (e.g., via firewall/egress filtering/ACLs).
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated exploitation?
Any reachable DataGear instance through version 6.0.0 is exposed if the /dataSet/preview/Http endpoint is accessible over the network. No authentication is required to send requests to the vulnerable endpoint.
What can an attacker do through the vulnerable endpoint?
An attacker can supply a URI that causes the server to make arbitrary HTTP requests, including GET, POST, PUT, PATCH, and DELETE requests. The attacker can target internal services or cloud metadata endpoints and receive the full response body.
How can I determine whether a system is affected?
Verify whether the instance runs DataGear version 6.0.0 or earlier and whether /dataSet/preview/Http is reachable. Requests to that endpoint that accept a caller-controlled URI and return the fetched response indicate exposure.