SSRF Vulnerability in Wyoming API

Wyoming versions prior to 1.10.2 are susceptible to a server-side request forgery (SSRF) vulnerability (CVE-2026-8712). The flaw resides in the handling of the 'uri' query parameter within the application's HTTP API. An unauthenticated attacker with network access to the API can craft malicious requests to endpoints including /api/info, /api/speech-to-text, and /api/text-to-speech. By supplying an arbitrary URI using 'tcp://' or 'unix://' protocols, an attacker can override the server-configured backend settings, forcing the application to initiate unauthorized outbound connections. This capability allows attackers to bypass network perimeters, perform reconnaissance on internal services, or interact with sensitive endpoints that are otherwise unreachable from the public internet. Given the potential for lateral movement and access to internal data, this vulnerability represents a significant risk for deployments exposed to untrusted networks.

Impact

Successful exploitation allows unauthenticated attackers to perform server-side request forgery, potentially leading to unauthorized interaction with internal services or restricted network infrastructure. If exploited, an attacker could gain insights into internal network topology, extract information from local services, or potentially trigger further downstream vulnerabilities, depending on the environment where Wyoming is deployed.

Recommendation

1. Upgrade all instances of Wyoming to version 1.10.2 or later to remediate the SSRF vulnerability in the API.
2. Implement network segmentation to restrict access to the Wyoming HTTP API endpoints to trusted IP addresses only.
3. Deploy egress filtering on the host machine running Wyoming to limit outbound connections to only authorized internal backend services or external destinations.
4. Monitor web access logs for unusual 'uri' parameters containing 'tcp://' or 'unix://' prefixes directed at /api/info, /api/speech-to-text, or /api/text-to-speech.