CVE-2026-121561

Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.23.2 label-studio-sdk versions prior to 2.1.2

Description Authenticated users can perform a server-side request forgery (SSRF), which occurs when a server is tricked into making requests to an unintended location. This issue allows the reading of internal URLs via image-bearing export formats. An attacker can import tasks where the data.image variable points to internal services and then export them as YOLO or COCO formats with images to read the responses. Additionally, by spoofing the Host header, an attacker can capture the API token of the organization owner.

Recommendations Update Label Studio to version 1.23.2 or later. Update label-studio-sdk to version 2.1.2 or later.