CVE Watch29 oct 2026

CVE-2026-13303

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that ma

CVSS

8.7

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 29 oct 2026 · Última mod.: 29 oct 2026 · CWE-918

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue outbound requests to a network destination of the requester's choosing and to receive the response. This may expose endpoints reachable only from the controller's host, such as a cloud instance metadata service. This vulnerability, CVE-2026-13303, is fixed in Boundary Enterprise 1.0.2 and 0.21.6.

Referencias oficiales

discuss.hashicorp.comhttps://discuss.hashicorp.com/t/hcsec-2026-54-boundary-vulnerable-to-server-side-request-forgery-in-vault-credential-store/77932

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1187666.1 MED

—

———Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make one blind request to an otherwise unreachable internal HTTP service. The primary impact is blind SSRF that might affect internal services with non-idempotent GET handlers, and response timing can provide a coarse internal-service oracle. This issue is fixed in version 3.13.0.7h CVE-2026-1191225.3 MED

—

———Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.4h CVE-2026-1043315.4 MED

—

———IBM Langflow OSS 1.0.0 through 1.12.3 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.9h CVE-2026-1043154.3 MED

—

———IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.9h CVE-2026-1025905.0 MED

—

———IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.9h