CVE-2026-55160

Name of the Vulnerable Software and Affected Versions Stringer versions prior to commit 75cb095

Description An unrestricted Server-Side Request Forgery (SSRF) allows authenticated users to force the server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata endpoints, such as the AWS Instance Metadata Service (IMDS) at 169.254.169.254. When the Setting::UserSignup feature is enabled, low-privileged registered users can exploit this to scan internal services or steal cloud Identity and Access Management (IAM) credentials.

Recommendations Update Stringer to the version containing commit 75cb095.