CVE-2026-9464: YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery

Published May 25, 2026

Updated

A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/data-sink/create of the component Admin API Endpoint. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

YunaiV yudao-cloud=2026.03

Event History

May 25, 2026

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Feb 1, 58701

Event

via FIRST·02:40 PM

Frequently Asked Questions

What is the severity of CVE-2026-9464?

CVE-2026-9464 has a low severity rating of 2.

What type of vulnerability is identified in CVE-2026-9464?

CVE-2026-9464 is a server-side request forgery (SSRF) vulnerability.

How can CVE-2026-9464 be exploited?

CVE-2026-9464 can be exploited remotely through the manipulation of the IotDataSinkHttpConfig function.

What component of YunaiV yudao-cloud is affected by CVE-2026-9464?

CVE-2026-9464 affects the Admin API Endpoint component in YunaiV yudao-cloud.

What is the impact of the CVE-2026-9464 vulnerability?

The impact of CVE-2026-9464 includes potential unauthorized access to system resources through server-side request forgery.