CVE-2026-9813: FlowIntel external reference URL probe allows server-side request forgery
FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL probe functionality in app/case/task.py. An attacker who can submit an external reference URL can cause the application server to issue an HTTP HEAD request to an attacker-specified destination. Due to insufficient validation of the URL scheme and resolved destination address, affected versions may allow requests to loopback, link-local, private, reserved, or other restricted network resources, potentially enabling interaction with internal services or cloud metadata endpoints from the server's network context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FlowIntelto a version that resolves this vulnerability.Fixed in 3.3.0 - Compensating control
Restrict outbound network egress from the application server to prevent the server-side HTTP HEAD requests from reaching loopback, link-local, private, reserved, or other restricted network resources and cloud metadata endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9813?
CVE-2026-9813 has a medium severity rating of 6.2.
What type of vulnerability is identified in CVE-2026-9813?
CVE-2026-9813 identifies a server-side request forgery (SSRF) vulnerability.
How do I fix CVE-2026-9813?
To fix CVE-2026-9813, upgrade FlowIntel to version 3.3.1 or later that addresses this SSRF issue.
What is the impact of exploiting CVE-2026-9813?
Exploiting CVE-2026-9813 can allow an attacker to perform unauthorized HTTP HEAD requests to potentially sensitive internal services.
Which versions of FlowIntel are affected by CVE-2026-9813?
FlowIntel versions up to and including 3.3.0 are affected by CVE-2026-9813.