CVE-2026-112254
Deferred Deferred - Pending Action

Server-Side Request Forgery in agit8or1 clientst0r

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.17.587 addresses this issue. The patch is identified as 7e75c6cc6a07621c10be9b07fafd99e89a02e327. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112254
EUVD
EUVD-2026-104590

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
agit8or1 clientst0r 3.17.586

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the agit8or1 clientst0r platform up to version 3.17.586. It allows authenticated users to manipulate the URL parameter in the Property URL Importer component to make the server fetch arbitrary internal addresses, including loopback, private networks, or metadata services.

Detection Guidance

To detect this SSRF vulnerability, check if your clientst0r instance is running a version prior to 3.17.587. Inspect logs for requests to internal addresses via the /locations/<id>/import-property-from-url/ endpoint. Look for unusual outbound connections to RFC1918 ranges, loopback addresses, or metadata services like 169.254.169.254.

Impact Analysis

An attacker could exploit this to access internal systems, bypass network restrictions, or exfiltrate sensitive data from internal services. Since the platform is self-hosted for MSPs, this could compromise client data or infrastructure.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. It undermines access controls and data segregation in multi-tenant environments.

Mitigation Strategies

Upgrade clientst0r to version 3.17.587 or later immediately. The patch introduces strict URL validation in core/safe_http.py, blocking internal addresses, credentials, and DNS rebinding attempts. No configuration changes are required beyond the upgrade.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart