CVE-2026-40089
SSRF Vulnerability in Sonicverse Dashboard Enables Arbitrary Requests
Publication date: 2026-04-09
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sonicverse | sonicverse | to cb1ddbacafcb441549fe87d3eeabdb6a085325e4 (inc) |
| sonicverse | radio_audio_streaming_stack | From cb1ddbacafcb441549fe87d3eeabdb6a085325e4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-40089 is a critical Server-Side Request Forgery (SSRF) vulnerability in the Sonicverse Radio Audio Streaming Stack dashboard API client. The dashboard accepts user-controlled URLs and forwards them directly to a server-side HTTP client without sufficient validation. This allows an authenticated operator to make arbitrary HTTP requests from the dashboard backend to internal or external systems.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to internal services that are not exposed to the internet, such as metadata APIs or admin panels. An attacker can interact with cloud instance metadata endpoints, bypass IP-based access controls and network segmentation, and pivot from the dashboard into otherwise inaccessible infrastructure. This can compromise confidentiality and integrity of systems.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this SSRF vulnerability involves identifying if the Sonicverse Radio Audio Streaming Stack dashboard is forwarding user-controlled URLs to its backend HTTP client without proper validation.
You can check the version of the installed software and verify if it includes the fix from commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4 or later.
Additionally, monitoring network traffic from the dashboard backend for unusual outbound HTTP requests to internal or unexpected external IP addresses can help detect exploitation attempts.
- Use git to check the commit of the installed dashboard code: `git log -1 -- apps/dashboard/lib/api.ts`
- Use network monitoring tools like tcpdump or Wireshark to capture outbound HTTP requests from the dashboard host: `tcpdump -i <interface> tcp port 80 or 443`
- Search logs for unusual HTTP requests or requests to internal IP ranges from the dashboard backend.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling or tightly restricting any dashboard features that allow user submission or influence over target URLs.
Enforce strict firewall and network policies to prevent the dashboard backend from making HTTP requests to internal networks or cloud metadata endpoints.
Limit outbound traffic from the host running the dashboard to only necessary domains.
However, these mitigations do not fully resolve the SSRF risk.
The strongly recommended action is to update or reinstall the Sonicverse Radio Audio Streaming Stack from a fixed commit at or after cb1ddbacafcb441549fe87d3eeabdb6a085325e4, which implements strict validation and constraints on destination URLs.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-40089 SSRF vulnerability in the Sonicverse Radio Audio Streaming Stack dashboard allows an authenticated operator to make arbitrary HTTP requests from the backend to internal or external systems. This can lead to unauthorized access to internal services, bypassing network segmentation and IP-based access controls.
Such unauthorized access and potential data exposure could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and systems to protect confidentiality and integrity.
Because the vulnerability enables attackers to pivot into otherwise inaccessible infrastructure and potentially access sensitive information, it increases the risk of data breaches and unauthorized data processing, which are critical compliance concerns under these regulations.
Mitigations such as strict validation, allow-listing, and network restrictions are recommended, but until fully remediated, the vulnerability poses a significant compliance risk.