CVE-2026-72552

Name of the Vulnerable Software and Affected Versions Dub versions prior to 2026-07-10

Description An unauthenticated remote attacker can induce the server to issue HTTP requests to arbitrary internal or external hosts. This occurs via the 'metatags edge' endpoint, which fetches any caller-supplied URL without requiring authentication or applying a denylist. This flaw can be leveraged to scan internal services or exfiltrate data from cloud metadata endpoints. Server-Side Request Forgery (SSRF) is a flaw where an attacker forces a server to make requests to a destination of the attacker's choosing.

Recommendations Update to a version released after 2026-07-10. Restrict access to the 'metatags edge' endpoint to minimize the risk of exploitation.