{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cog--0.23.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-56712"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cog (\u003c= 0.23.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Replicate"],"content_html":"\u003cp\u003eCVE-2026-56712 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Replicate Cog library. The \u003ccode\u003ecog.types.File.validate()\u003c/code\u003e and \u003ccode\u003ecog.types.Path.validate()\u003c/code\u003e functions fail to perform destination validation when processing user-provided HTTP(S) URLs. Because the library uses the \u003ccode\u003erequests\u003c/code\u003e library with default settings, it automatically follows redirects, allowing an attacker to reach internal or loopback resources by first contacting an attacker-controlled redirector. A public proof-of-concept exists, though no active exploitation has been confirmed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to make requests to internal services, local loopback resources (e.g., administrative interfaces, internal APIs), and cloud metadata services (e.g., \u003ccode\u003e169.254.169.254\u003c/code\u003e), which could lead to unauthorized information disclosure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Cog to a version incorporating the fix described in the provided \u003ccode\u003efix.md\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, ensure that any user-controlled input to \u003ccode\u003ecog.File\u003c/code\u003e or \u003ccode\u003ecog.Path\u003c/code\u003e is strictly validated against a known allowlist of domains or CIDRs.\u003c/li\u003e\n\u003cli\u003eImplement a dedicated fetch proxy that enforces hostname resolution validation, disables automatic redirects, and blocks private/loopback address ranges (including \u003ccode\u003e169.254.169.254\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T07:20:33Z","date_published":"2026-11-09T07:20:33Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-56712/","summary":"Replicate Cog versions 0.23.1 and earlier are vulnerable to Server-Side Request Forgery (SSRF) due to improper URL validation in File and Path validators, enabling internal or loopback resource access.","title":"Replicate Cog: Server-Side Request Forgery vulnerability (CVE-2026-56712)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-56712/"}],"language":"en","title":"CraftedSignal Threat Feed - Cog (\u003c= 0.23.1)","version":"https://jsonfeed.org/version/1.1"}