CVE-2026-82040

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16

Description An authenticated attacker can trigger a server-side request forgery (SSRF) by providing a malicious metadata URL to the POST/PUT /api/identity-providers endpoint. This occurs because the IdentityProviderService.validateMetadataUrl() function fails to validate the target host, IP, or scheme. This flaw allows the server to send requests to arbitrary internal or cloud metadata hosts, enabling internal network port scanning and unauthorized access to cloud instance-metadata services.

Recommendations Update UTMStack to version 11.2.16 or later. As a temporary mitigation, restrict access to the /api/identity-providers endpoint.