Unauthenticated SSRF in MegaParse

MegaParse version 0.0.55 contains a critical server-side request forgery (SSRF) vulnerability in the POST /v1/url endpoint. The application insecurely handles caller-supplied URLs, allowing unauthenticated remote attackers to force the server to perform HTTP requests to arbitrary destinations. By providing internal network addresses or cloud provider metadata service endpoints (e.g., 169.254.169.254) as input, an attacker can bypass access controls and receive the content of those internal requests directly in the application's JSON response. This vulnerability poses a significant risk to organizations deploying MegaParse in cloud-native environments, as it facilitates sensitive data exfiltration, internal reconnaissance, and potential compromise of cloud identity roles.

Impact

Successful exploitation allows unauthenticated attackers to read responses from internal services that are otherwise unreachable from the internet. In cloud environments, this may result in the exfiltration of IAM credentials or sensitive metadata, leading to privilege escalation or further lateral movement within the cloud infrastructure.

Recommendation

• Update MegaParse to a version that addresses CVE-2026-85691 immediately.
• Implement egress filtering on the host running MegaParse to prevent connections to internal RFC1918 address space and cloud metadata services.
• Monitor web application logs for POST requests to /v1/url that contain suspicious or internal-only URLs in the request body.