CVE-2026-102923
Received Received - Intake

Server-Side Request Forgery in SparkyFitness AI Service

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-102923
EUVD
EUVD-2026-102914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
CodeWithCJ SparkyFitness < 1.6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in SparkyFitness affecting versions before 1.6.0. It allows authenticated users to send arbitrary HTTP POST requests from the server to internal or external hosts by exploiting unvalidated custom AI service URLs. The attacker controls both the destination URL and the Authorization header value.

Detection Guidance

Monitor outbound POST requests from your SparkyFitness server to unexpected internal or external destinations. Check server logs for requests to private IP ranges or cloud metadata endpoints. Use network monitoring tools like tcpdump or Wireshark to inspect traffic from the SparkyFitness process.

Impact Analysis

An attacker could probe internal network services, leak the AI system prompt, or make unauthorized requests on behalf of the server. This could lead to data breaches, unauthorized access to sensitive information, or further network compromise if internal services are vulnerable.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations and potential regulatory penalties.

Mitigation Strategies

Upgrade to SparkyFitness version 1.6.0 or later immediately. Set the environment variable ALLOW_PRIVATE_NETWORK_AI=false to block access to private networks. Review and restrict custom AI service URL configurations to trusted domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-102923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart