CVE-2026-127093
Received Received - Intake

Rustrak SSRF via routing_override.url in Integrations Test

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-127093
EUVD
EUVD-2026-125090

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
rustrak rustrak From 0 (inc) to 0.26.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Rustrak before version 0.26.0. It allows users with integrations update permission to send HTTP requests to arbitrary destinations by providing a routing_override.url parameter to the POST /api/integrations/{id}/test endpoint. Attackers can target loopback addresses, private networks, and cloud metadata endpoints, including custom headers and redirects. Non-2xx response bodies from these requests are exposed in the API response.

Detection Guidance

Check Rustrak server logs for unusual outbound requests from the POST /api/integrations/{id}/test endpoint. Monitor network traffic for connections to loopback, private, or cloud metadata addresses originating from the Rustrak process. Use tools like tcpdump or Wireshark to inspect traffic from the Rustrak server.

Impact Analysis

An attacker could exploit this to send requests to internal services, potentially reading sensitive data from internal hosts or cloud metadata endpoints. They could also exfiltrate internal service responses through the API. This could lead to data breaches, unauthorized access to internal systems, or further network reconnaissance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to potential data breaches, unauthorized data exposure, and insufficient access controls.

Mitigation Strategies
  • Upgrade Rustrak to version 0.26.0 or later to apply the security fixes.
  • Disable the routing_override.url parameter in test endpoints if not required for operations.
  • Review and restrict permissions for users who can update integrations to minimize attack surface.
  • Monitor for any outbound requests to private or loopback addresses from the Rustrak server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...