Server-Side Request Forgery in LobeChat

Executive Summary

CVE-2026-59095 is a Server-Side Request Forgery (SSRF) vulnerability in LobeChat versions before 2.2.10-canary.18. It affects two authenticated endpoints: the skill import service (importFromUrl) and the topic cover update (fetchImageFromUrl). These endpoints use the global fetch function without the project's ssrf-safe-fetch wrapper, allowing attackers to supply arbitrary URLs.

Because of this, authenticated attackers can make the server send HTTP requests to internal addresses, including cloud instance metadata endpoints, which are normally protected. This can lead to disclosure of internal service responses and cloud credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers to make the server perform HTTP requests to arbitrary internal URLs, potentially exposing sensitive internal data.

• Disclosure of internal service responses.
• Exposure of cloud credentials via access to cloud instance metadata endpoints.
• Potential unauthorized access to internal network resources.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves authenticated attackers exploiting two specific endpoints (importFromUrl and fetchImageFromUrl) in LobeChat to make server-side requests to arbitrary URLs, including internal addresses. Detection can focus on monitoring for unusual or unauthorized HTTP requests originating from these endpoints.

To detect exploitation attempts on your system or network, you can monitor HTTP logs for requests to these endpoints with suspicious or unexpected URLs, especially those targeting internal IP ranges such as 169.254.169.254 (cloud metadata service).

• Check server logs for POST requests to endpoints like `/agentSkills.importFromUrl` and `/generationTopic.updateTopicCover` containing URLs pointing to internal IP addresses or cloud metadata endpoints.
• Use network monitoring tools to detect outbound HTTP requests from the server to internal IP ranges or unusual destinations.
• Example command to search logs for suspicious URLs (assuming logs are in JSON or text format):

grep -E 'importFromUrl|updateTopicCover' /path/to/server/logs | grep -E '169\.254\.169\.254|127\.0\.0\.1|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.'

Alternatively, use network packet capture tools like tcpdump or Wireshark to filter HTTP traffic from the server to internal IP ranges.

Example tcpdump command to capture HTTP requests to internal IPs:

tcpdump -i eth0 tcp and dst net 169.254.0.0/16 or dst net 10.0.0.0/8 or dst net 172.16.0.0/12 or dst net 192.168.0.0/16

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade LobeChat to version 2.2.10-canary.18 or later, where the vulnerability has been fixed by routing the affected fetch calls through the project's `ssrf-safe-fetch` wrapper.

This fix blocks requests to private and link-local IP addresses at connection time and re-checks every redirect hop, preventing SSRF attacks targeting internal services and cloud metadata.

• Upgrade LobeChat to version 2.2.10-canary.18 or newer.
• Audit your codebase for any other uses of the raw global `fetch` function that might bypass SSRF protections and replace them with `ssrf-safe-fetch`.
• If upgrading immediately is not possible, restrict access to the vulnerable endpoints (`importFromUrl` and `fetchImageFromUrl`) to trusted users only.
• Implement network-level controls to block outgoing HTTP requests from the server to internal IP ranges or cloud metadata endpoints.

These steps will help prevent attackers from exploiting the SSRF vulnerability to access internal services or cloud credentials.

Useful 0 Not Useful 0