CVE-2026-46556

Name of the Vulnerable Software and Affected Versions FlaskBB (affected versions not specified)

Description A Server-Side Request Forgery (SSRF) exists where authenticated users can force the server to send HTTP requests to arbitrary internal endpoints, such as cloud metadata services. This is a blind SSRF that enables internal port scanning and the triggering of internal APIs. The issue occurs because the url parameter is passed to the requests.get() function within the get image info() function without validation of the scheme, host, or IP address.

Technical details include:

Attackers can use this to access private network resources, leak IAM credentials on cloud deployments (AWS, GCP, Azure), or reach internal services such as Elasticsearch, etcd, and Consul.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the url parameter in the affected API endpoints to prevent requests to internal IP addresses and cloud metadata services.