CVE-2026-85691
Received Received - Intake

Unauthenticated SSRF in MegaParse via URL Fetch Endpoint

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85691
EUVD
EUVD-2026-71140

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the-vibe-company megaparse to 0.0.55 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85691 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in MegaParse 0.0.55. It exists in the POST /v1/url endpoint, which fetches caller-supplied URLs server-side without authentication or validation. Attackers can supply internal service URLs or metadata endpoints, and the server returns their responses directly in the JSON output, exposing sensitive internal information.

Detection Guidance

To detect this SSRF vulnerability in MegaParse 0.0.55, test the POST /v1/url endpoint by sending requests with internal or metadata URLs. Use curl to send a POST request with a URL parameter pointing to internal services or localhost. Example: curl -X POST http://<target>/v1/url -H 'Content-Type: application/json' -d '{"url": "http://localhost:8000"}'.

Impact Analysis

This vulnerability allows unauthenticated attackers to access internal services or cloud metadata endpoints, potentially leading to theft of sensitive data, internal reconnaissance, or exposure of credentials. It could also enable attackers to bypass network restrictions and probe internal systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and non-compliance with regulatory standards.

Mitigation Strategies

Immediately restrict access to the POST /v1/url endpoint by requiring authentication. Implement strict URL validation to block requests to loopback, private, link-local, unique-local, and reserved IP ranges. Enforce an allowlist for http/https schemes and disable redirects. Update to the latest version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85691. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart