CVE-2026-79788
Received Received - Intake

SSRF and Response Reflection in Dradis Community Edition

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169.254.169.254) and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server issues a request to the attacker-supplied URL (server-side request forgery). For non-2xx responses, the target's response body is reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, making the SSRF readable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79788
EUVD
EUVD-2026-65700

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dradis community_edition From 5.1.0 (inc) to 5.2.0 (inc)
dradis community_edition 5.2.0
dradis community_edition *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Dradis Community Edition versions 5.1.0 through 5.2.0. The issue occurs because admin authorization checks are not enforced in the ProvidersController and AgentsController due to a missing constant in the Community Edition. This allows any authenticated non-admin user to create an AI provider with an arbitrary HTTP/HTTPS address, including internal hosts, and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server sends a request to the attacker-supplied URL, resulting in SSRF. Non-2xx responses are reflected back to the attacker, exposing internal service error messages or sensitive data.

Detection Guidance

Monitor network traffic for outbound requests to unexpected or internal IP addresses from the Dradis server. Check Dradis logs for AI provider interactions or agent reassignments. Look for error messages in the browser or server logs that reflect responses from internal services.

Impact Analysis

An attacker could exploit this to send requests to internal or external systems, potentially accessing sensitive data, enumerating internal services, or interacting with cloud metadata endpoints like AWS IMDS. The reflected error responses may expose internal service details, debug output, or partial credentials. This could lead to data breaches, unauthorized access, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of internal service details or credentials may result in non-compliance with data confidentiality and integrity mandates, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Apply the admin_required guard in ProvidersController and AgentsController. Block private/link-local IP ranges in network configurations. Update to a patched version if available. Restrict outbound HTTP/HTTPS requests from the Dradis server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart