CVE-2026-102879

Received Received - Intake

ClaraVerse SSRF Bypass via Download and Scrape Tools

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-102879

EUVD

EUVD-2026-89414

Affected Vendors & Products

Vendor	Product	Version / Range
claraverse	claraverse	0.3.1
claraverse	claraverse	to 0.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

ClaraVerse through version 0.3.1 has a Server-Side Request Forgery (SSRF) vulnerability in the download_file and scrape_web tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata endpoints.

Detection Guidance

To detect this vulnerability, check ClaraVerse logs for requests to internal services or cloud metadata endpoints. Look for URLs containing IPv6 transition addresses like NAT64, 6to4, or Teredo. Review the download_file and scrape_web tool usage for unusual destination patterns.

Impact Analysis

An attacker could exploit this to access internal services or cloud metadata, potentially stealing sensitive data, interacting with internal APIs, or probing internal network resources. This could lead to data breaches, unauthorized access, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Compliance may be compromised if internal systems or data are exposed.

Mitigation Strategies

Upgrade ClaraVerse to a patched version beyond v0.3.1. Temporarily disable the download_file and scrape_web tools if an update is unavailable. Implement network-level controls to block outbound requests to internal IP ranges and cloud metadata endpoints.

Hi! I’m here to help you understand CVE-2026-102879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70