CVE-2026-9464

Name of the Vulnerable Software and Affected Versions YunaiV yudao-cloud version 2026.03

Description An issue in the Admin API Endpoint component allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the manipulation of the IotDataSinkHttpConfig function within the '/admin-api/iot/data-sink/create' endpoint. The attack can be executed remotely.

Recommendations As a temporary mitigation, restrict access to the '/admin-api/iot/data-sink/create' endpoint or disable the IotDataSinkHttpConfig function. At the moment, there is no information about a newer version that contains a fix for this vulnerability.