CVE-2026-8712
Received Received - Intake

Server-Side Request Forgery in Wyoming

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: VulnCheck

Description
Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers can pass arbitrary `tcp://` or `unix://` URIs to affected endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech to override the server-configured backend and redirect connections to attacker-chosen hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-8712
EUVD
EUVD-2026-69417

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in Wyoming versions before 1.10.2. It allows unauthenticated attackers with network access to force the server to make outbound connections to arbitrary targets by supplying a malicious uri query parameter to HTTP API endpoints like /api/info, /api/speech-to-text, and /api/text-to-speech. Attackers can override the server-configured backend by passing tcp:// or unix:// URIs to redirect connections to attacker-chosen hosts.

Detection Guidance

Monitor network traffic for unexpected outbound connections to arbitrary hosts or unusual use of tcp:// or unix:// URIs in HTTP requests to /api/info, /api/speech-to-text, or /api/text-to-speech endpoints. Check server logs for unauthorized uri query parameters.

Impact Analysis

An attacker could exploit this to access internal systems, exfiltrate data, or pivot to other network resources. It may also enable denial-of-service attacks by forcing the server to connect to unintended targets. Sensitive information could be leaked if the server exposes error details during such requests.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Wyoming to version 1.10.2 or later. Ensure HTTP servers require --uri or --allow-uri-override flags and reject uri query parameters unless explicitly allowed. Restrict request URIs to tcp:// and unix:// schemes only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8712. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart