CVE-2026-100391: Server-Side Request Forgery in MediaFlow Proxy

MediaFlow Proxy through version 2.4.9 contains a high-severity server-side request forgery (SSRF) vulnerability. The flaw exists within the /proxy endpoint, where the application fails to perform sufficient validation on the 'd' query parameter. This allows an unauthenticated remote attacker to craft requests that force the proxy server to retrieve data from arbitrary internal or external URLs.

Defenders must be aware that this vulnerability enables attackers to interact with internal-only services, including loopback (127.0.0.1) addresses and cloud provider metadata services (e.g., 169.254.169.254), to potentially exfiltrate sensitive environment credentials or configuration data. Because this vulnerability exists in the request routing logic, it does not require prior authentication, making it a significant risk for internet-facing instances of MediaFlow Proxy.

Impact

Successful exploitation allows attackers to bypass network perimeters, probe internal network segments, and access protected cloud instance metadata services, which often contain highly sensitive IAM credentials and environment-specific configuration secrets.

Recommendation

• Upgrade MediaFlow Proxy to a patched version beyond 2.4.9 immediately to remediate CVE-2026-100391.
• Until patching is complete, restrict access to the /proxy endpoint via Web Application Firewall (WAF) or reverse proxy configurations.
• Audit web server access logs for anomalous requests to the /proxy endpoint that contain internal-only URI schemes, IP addresses, or metadata service paths.