CVE-2026-105048

Received Received - Intake

SSRF in Zilliz Attu Before 3.0.0

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: MITRE

Description

The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-02

Generated

2026-10-03

AI Q&A

2026-10-03

EPSS Evaluated

N/A

NVD

CVE-2026-105048

EUVD

EUVD-2026-91835

Affected Vendors & Products

Vendor	Product	Version / Range
zilliz	attu	to 3.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1289	The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attack-Flow Graph

Executive Summary

The vulnerability in Zilliz Attu before version 3.0.0 is an SSRF (Server-Side Request Forgery) issue in the Playground feature. This allows attackers to make the server send requests to private IP addresses, potentially accessing internal systems.

Detection Guidance

This vulnerability involves SSRF in Zilliz Attu before 3.0.0. To detect it, monitor network traffic for outbound requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) from the Attu service. Check logs for proxy or SSRF-related errors. Use tools like curl to test if the Playground feature allows requests to internal addresses.

Impact Analysis

This vulnerability could allow unauthorized access to internal networks or services if exploited. Attackers might probe private IP ranges, exfiltrate data, or interact with internal applications through the vulnerable server.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive information.

Mitigation Strategies

Upgrade Zilliz Attu to version 3.0.0 or later to address the SSRF vulnerability in the Playground feature.

Hi! I’m here to help you understand CVE-2026-105048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70