CVE-2026-111313

Received Received - Intake

Server-Side Request Forgery in JobOps

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111313

Affected Vendors & Products

Vendor	Product	Version / Range
DaKheera47	JobOps	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

JobOps through 0.13.1 has a server-side request forgery (SSRF) vulnerability in the POST /api/manual-jobs/fetch endpoint. This flaw allows authenticated users or unauthenticated clients in demo mode to force the server to fetch internal or external destinations by supplying a URL in the request. Attackers can specify loopback, private, or cloud metadata addresses to read the returned page content, which may expose instance metadata and internal service data.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual outbound requests from the JobOps server, especially to internal or loopback addresses. Check server logs for POST requests to /api/manual-jobs/fetch with suspicious URLs in the url field. Use tools like curl to test if the server fetches arbitrary internal endpoints.

Impact Analysis

This vulnerability can lead to unauthorized access to internal services, exposure of sensitive instance metadata, and potential disclosure of internal service data. Attackers could leverage this to gather information about the server environment, which may aid in further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to internal service data and instance metadata, potentially exposing sensitive information. This may violate GDPR's data protection requirements if personal data is disclosed, and HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Immediately update JobOps to the latest version beyond 0.13.1. Restrict network access to the JobOps server to prevent unauthorized outbound requests. Disable demo mode if enabled. Review and filter requests to /api/manual-jobs/fetch to block internal or loopback URLs.

Hi! I’m here to help you understand CVE-2026-111313. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70