Authorization Bypass and SSRF in Dradis Community Edition

Dradis Community Edition contains an authorization bypass vulnerability (CVE-2026-79788) within the ProvidersController and AgentsController. The application improperly gates the admin_required before_action by checking for the Dradis::Pro constant, which is never defined in the Community Edition. This failure causes the authorization check to be skipped entirely, allowing any authenticated, non-privileged user to modify AI provider and agent configurations. Attackers can leverage this to create malicious AI providers that point to internal or cloud-local network addresses, including metadata services such as 169.254.169.254. When an AI interaction is subsequently triggered, the application performs an outbound request to the attacker-defined URL. Because the application reflects response bodies of non-2xx status codes via ActionCable/Turbo Stream, an attacker can read the content of internal network resources, leading to potential data exfiltration.

Impact

Successful exploitation allows authenticated users to perform server-side request forgery against internal resources or cloud metadata services. This can result in unauthorized access to sensitive internal configuration data, cloud environment credentials, or metadata, facilitating deeper compromise of the environment.

Recommendation

• Monitor web server and application logs for unexpected outbound connections from the Dradis server, particularly to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.169.254).
• Review access logs for non-administrative users interacting with the /providers and /agents controller endpoints.
• Apply security patches or updates provided by the vendor to address CVE-2026-79788.
• Implement egress filtering at the network level to restrict the Dradis server from initiating requests to internal or metadata-related IP addresses.