{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aunstructuredunstructured/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:unstructured:unstructured:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-71428"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["unstructured (\u003e= 0.4.7, \u003c 0.24.0)"],"_cs_severities":["medium"],"_cs_tags":["ssrf","library-vulnerability","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe \u003ccode\u003eunstructured\u003c/code\u003e Python library, widely used for URL ingestion in agent frameworks such as LangChain and LlamaIndex, contains a critical Server-Side Request Forgery (SSRF) vulnerability. The flaw exists in the \u003ccode\u003epartition()\u003c/code\u003e, \u003ccode\u003epartition_html()\u003c/code\u003e, and \u003ccode\u003epartition_md()\u003c/code\u003e functions, which utilize \u003ccode\u003erequests.get()\u003c/code\u003e to fetch remote content without performing host validation, URL filtering, or restricting requests to private/loopback IP spaces.\u003c/p\u003e\n\u003cp\u003eThis vulnerability allows an attacker to provide an arbitrary URL to these functions, which the application then requests. Because the library returns the response body as text, it facilitates a full-read SSRF. This enables attackers to reach sensitive internal services, such as administrative APIs, databases, and microservices, or to query cloud instance metadata services (IMDS). The vulnerability has existed since version 0.4.7 (February 2023) and remains present in versions up to 0.24.0. The lack of timeouts in \u003ccode\u003epartition_md()\u003c/code\u003e further introduces potential denial-of-service risks via slow-loris patterns.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an internet-facing application that uses the \u003ccode\u003eunstructured\u003c/code\u003e library to process user-provided URLs (e.g., an LLM agent feature or link-preview generator).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious URL pointing to an internal resource (e.g., \u003ccode\u003ehttp://127.0.0.1:80\u003c/code\u003e or \u003ccode\u003ehttp://169.254.169.254/latest/meta-data/\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker submits the crafted URL to the target application's ingestion endpoint.\u003c/li\u003e\n\u003cli\u003eThe application passes the URL to \u003ccode\u003eunstructured.partition.auto.partition()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe library performs an unvalidated HTTP GET request to the target internal host using the server's identity.\u003c/li\u003e\n\u003cli\u003eThe target internal service processes the request and returns sensitive data (e.g., IMDS credentials or admin dashboard HTML) to the library.\u003c/li\u003e\n\u003cli\u003eThe library parses the returned sensitive data as document text and embeds it into the LLM context or application output.\u003c/li\u003e\n\u003cli\u003eAttacker views the output containing the exfiltrated sensitive data.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to perform reconnaissance on internal networks, gain access to sensitive internal HTTP services (e.g., Redis, Consul, Kubernetes API), and exfiltrate cloud instance credentials from metadata endpoints that permit unauthenticated GET requests. Organizations leveraging this library within agentic frameworks are at significant risk of unauthorized internal access, as the vulnerability resides within the ingestion layer, making every downstream implementation potentially susceptible.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eunstructured\u003c/code\u003e library to version 0.24.0 or later immediately to patch CVE-2026-71428.\u003c/li\u003e\n\u003cli\u003eIf an immediate upgrade is not possible, implement strict URL validation logic at the application layer to block requests to private IP ranges (e.g., \u003ccode\u003e10.0.0.0/8\u003c/code\u003e, \u003ccode\u003e172.16.0.0/12\u003c/code\u003e, \u003ccode\u003e192.168.0.0/16\u003c/code\u003e, \u003ccode\u003e127.0.0.0/8\u003c/code\u003e) and the cloud metadata link-local address (\u003ccode\u003e169.254.169.254\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eRestrict egress traffic from servers running document ingestion workflows using host-based firewalls or network egress filtering to prevent unauthorized internal connectivity.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-03T18:03:56Z","date_published":"2026-09-03T18:03:56Z","id":"https://feed.craftedsignal.io/briefs/2026-09-unstructured-ssrf/","summary":"The Unstructured library is vulnerable to unauthenticated full-read Server-Side Request Forgery (SSRF) via the partition(), partition_html(), and partition_md() functions, allowing attackers to access internal network services and cloud metadata endpoints.","title":"Server-Side Request Forgery in Unstructured URL Partitioning","url":"https://feed.craftedsignal.io/briefs/2026-09-unstructured-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:unstructured:unstructured:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}