Zylon PrivateGPT: Server-side request forgery (CVE-2026-116000)
A server-side request forgery vulnerability in Zylon PrivateGPT versions 1.0.0 and 1.0.1 allows remote attackers to perform unauthorized requests via the URI Artifact Loader component.
CVE search metadata
CVE search record: CVE-2026-116000. Severity: high. CVSS: 7.3. KEV: no. Product: PrivateGPT (1.0.0, 1.0.1). Brief: Zylon PrivateGPT: Server-side request forgery (CVE-2026-116000). Brief link: https://feed.craftedsignal.io/briefs/2026-10-zylon-privategpt-ssrf/
Triage facts
Revision 1- Applicability
- PrivateGPT (1.0.0, 1.0.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 25, 04:25 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A server-side request forgery (SSRF) vulnerability exists in the URI Artifact Loader component of Zylon PrivateGPT, specifically within the load_file_from_uri function of private_gpt/server/ingest/uri_loader.py. The vulnerability arises from improper handling of the Value argument, which can be manipulated by a remote attacker to force the server to make unintended network requests. Public exploit code for this vulnerability is available. The vendor has not responded to vulnerability disclosures.
Impact
Successful exploitation allows a remote attacker to perform SSRF, potentially accessing internal services, scanning private network segments, or exfiltrating sensitive data from the host environment or internal network accessible to the PrivateGPT server.
Recommendation
Prioritize the identification and isolation of internet-facing Zylon PrivateGPT instances. Given the lack of a vendor response or patch, restrict network access to these instances using egress filtering to prevent unauthorized internal requests.
Immediate actions
Identify all Zylon PrivateGPT instances in the environment.
Threat Hunt
Monitor web server access logs for unusual requests to URI-loading endpoints containing suspicious URI schemes (e.g., file://, gopher://, or internal 10/172/192 IP addresses) in the Value parameter.
Data: Web server access logs
Mitigations
Implement strict egress filtering on servers hosting PrivateGPT to block connections to private address spaces (RFC 1918) and non-essential external domains.
CVE-2026-116000