CVE-2026-76795
Received Received - Intake

Server-Side Request Forgery in PullMD

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulDB

Description
A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch is 96448894cc93ccecb0bdcbf263a9d25390a8455e. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-76795
EUVD
EUVD-2026-63190

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
aeternalabshq pullmd 3.2.0
aeternalabshq pullmd 3.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in PullMD 3.2.0. It allows attackers to manipulate the URL parameter in the /api endpoint to force the server to make unauthorized requests to internal or cloud metadata services. The server lacks proper input validation, enabling it to fetch and return sensitive metadata like instance initialization scripts, which may contain credentials or configuration details.

Detection Guidance

To detect this SSRF vulnerability in PullMD 3.2.0, monitor network traffic for outbound requests from the /api endpoint to internal or cloud metadata IP ranges. Check logs for HTTP 403 errors after upgrading to 3.3.0, which indicate blocked SSRF attempts. Use tools like curl to test the endpoint with crafted URLs pointing to metadata services (e.g., curl 'http://your-pullmd/api?url=http://100.100.100.200/latest/user-data').

Inspect environment variables for PULLMD_ALLOWED_HOSTS to identify misconfigured allowlists. Verify if the ssrf.js guard is active by checking the presence of the 96448894cc93ccecb0bdcbf263a9d25390a8455e patch in the codebase.

Impact Analysis

An attacker could exploit this to access sensitive cloud metadata (e.g., AWS, Alibaba Cloud) via reserved IPs like 100.100.100.200, retrieve instance user-data scripts, and potentially gain full server access. This could lead to data breaches, unauthorized code execution, or lateral movement within cloud environments.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access, violating GDPR's data protection principles (e.g., integrity, confidentiality) and HIPAA's safeguards for protected health information. A breach may result in regulatory penalties, reputational damage, and loss of trust due to exposed sensitive data.

Mitigation Strategies

Upgrade PullMD to version 3.3.0 or later immediately. Disable access to cloud metadata services via proxy APIs. Implement strict outbound request filtering to block requests to private, loopback, link-local, CGNAT, and cloud-metadata IP ranges. Set PULLMD_ALLOWED_HOSTS to explicitly allow only necessary internal hosts if self-hosting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart