CVE-2026-72560
Received Received - Intake

Server-Side Request Forgery in Label Studio

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An authenticated user can use this to reach internal services, cloud metadata endpoints, and other resources not intended for external access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72560
EUVD
EUVD-2026-56030

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
humansignal label_studio 1.24.0.dev0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in HumanSignal Label Studio through version 1.24.0.dev0. The issue occurs because the setting SSRF_PROTECTION_ENABLED is disabled by default. This allows authenticated users to make requests to internal services, loopback addresses, or cloud metadata endpoints via the import-from-URL endpoint, which should not be accessible externally.

Impact Analysis

An attacker with authenticated access could exploit this to access internal network resources, interact with cloud provider metadata services, or reach other sensitive services running on the same host. This could lead to unauthorized data exposure, service disruption, or further network compromise depending on the internal services exposed.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection and unauthorized access) and HIPAA (unauthorized access to protected health information) by allowing unauthorized parties to access sensitive internal systems or data. Organizations using Label Studio must ensure proper configuration and access controls to maintain regulatory compliance.

Mitigation Strategies

Set SSRF_PROTECTION_ENABLED to true in Label Studio configuration to enable SSRF protection. Ensure the import-from-URL endpoint is restricted to only trusted external URLs and block access to internal loopback addresses and cloud metadata endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart