SSRF Vulnerability in Jina AI Reader via Incomplete Redirect Validation

Jina AI reader is susceptible to a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-85699. The flaw exists because the application performs URL validation exclusively on the initial request URL. If the initial URL returns an HTTP redirect, the application follows the subsequent location header without re-validating the final destination against the same security policies. This allows an attacker to supply a legitimate-looking URL that redirects to internal-only endpoints, such as local network services (e.g., localhost, 127.0.0.1) or cloud metadata service endpoints (e.g., 169.254.169.254). By chaining these redirects, an attacker can coerce the application into fetching sensitive internal content and returning the response data to the user, potentially leading to unauthorized data exposure or interaction with internal APIs.

Impact

The vulnerability allows an attacker to perform SSRF attacks, which can lead to the exfiltration of sensitive configuration data, cloud credentials from instance metadata services, or the reconnaissance of internal network infrastructure. Successful exploitation could compromise internal services that are not designed to be exposed to the internet.

Recommendation

• Ensure that the Jina AI reader application is updated to the latest available version that patches the redirect validation logic for CVE-2026-85699.
• Implement strict allowlists for destination URLs to ensure that the application only requests permitted domains.
• Configure network-level egress filtering to prevent the application from making outbound requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.169.254) unless strictly necessary.