CVE-2026-85179
Received Received - Intake

Label Studio Webhook URL Validation Bypass Leading to Internal Service Interaction

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85179
EUVD
EUVD-2026-70483

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
label_studio label_studio to 1.23.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Label Studio through version 1.23.0 has a Server-Side Request Forgery (SSRF) vulnerability due to improper validation of webhook URLs. Authenticated users can create webhooks targeting internal services, including private networks (RFC 1918 addresses) and cloud metadata endpoints. When triggered, Label Studio sends outbound HTTP requests to these URLs without SSRF protection, potentially allowing data exfiltration of annotation data.

Detection Guidance

Check Label Studio webhook configurations for URLs pointing to internal networks or cloud metadata endpoints. Inspect network traffic for outbound requests to RFC 1918 addresses or 169.254.169.254. Review logs for unauthorized SSRF attempts or data exfiltration patterns.

Impact Analysis

An attacker with authenticated access could exploit this to send requests to internal systems, exfiltrate sensitive annotation data, or retrieve cloud instance metadata. The impact includes unauthorized data access, potential internal network probing, and compromise of cloud environments via metadata endpoints.

Compliance Impact

This vulnerability could lead to unauthorized access and exfiltration of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using Label Studio may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies
  • Upgrade Label Studio to a version with SSRF protections (e.g., commit 2c1c1d6472153032af8ed399168f814bea854e3e).
  • Disable or restrict webhook creation for non-admin users until patched.
  • Implement network-level controls to block outbound requests to RFC 1918 and cloud metadata endpoints.
  • Monitor webhook logs for suspicious outbound requests to internal services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85179. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart