Tag

Cloud-Metadata

2 briefs RSS

DeepSeek TUI SSRF Vulnerability via HTTP Redirect Bypass (CVE-2026-45310)

DeepSeek TUI is vulnerable to a Server-Side Request Forgery (SSRF) attack (CVE-2026-45310) because the `fetch_url` tool validates the initial URL against a restricted-IP blocklist but fails to re-validate redirect targets, allowing attackers to exfiltrate sensitive information from cloud-hosted instances by using a redirect to a restricted IP address.

deepseek-tui +1 ssrf prompt-injection cloud-metadata

2r 1t 3i May 14, 2026

high advisory

Gotenberg SSRF via Chromium URL Endpoint with Redirect Bypass

2 rules 1 TTP 1 CVE 1 IOC

Gotenberg's Chromium URL-to-PDF conversion endpoint is vulnerable to SSRF due to a lack of default protection against HTTP/HTTPS-based requests, allowing attackers to target internal IPs and cloud metadata endpoints, which can be bypassed via HTTP redirects.

Gotenberg/v8 ssrf gotenberg cve-2026-42595 cloud-metadata

2r 1t 1c 1i May 11, 2026