CVE-2026-18973
Received Received - Intake

Server-Side Request Forgery in Super-Agent-Party Extension

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulDB

Description
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-18973
EUVD
EUVD-2026-53694

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
heshengtao super-agent-party to 0.4.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18973 is a Server-Side Request Forgery (SSRF) vulnerability in the super-agent-party application up to version 0.4.1. The issue is in the /extension_proxy route where the sanitize_proxy_url function fails to block requests to private or loopback addresses, only logging a warning and allowing the request to proceed. This lets attackers force the server to fetch internal resources and relay responses back.

Detection Guidance

To detect this SSRF vulnerability, check if your super-agent-party instance (versions <= 0.4.1) exposes the /extension_proxy route. Test by sending a request to a private IP or loopback address via this endpoint. If the server responds with the internal resource, the vulnerability exists.

Impact Analysis

An attacker could exploit this to access internal services like admin panels, metadata endpoints, or container services. The server would fetch these resources and return them to the attacker, enabling data theft, unauthorized access, or further attacks on internal systems.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using affected software may face compliance breaches if internal data is exfiltrated.

Mitigation Strategies

Immediately upgrade super-agent-party to a version beyond 0.4.1 if available. If no patch exists, disable the /extension_proxy route or restrict access to trusted sources only. Implement strict URL validation to block private IPs and loopback addresses in the sanitize_proxy_url function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18973. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart