CVE-2026-72560

Name of the Vulnerable Software and Affected Versions HumanSignal Label Studio versions prior to 1.24.0.dev0

Description An authenticated user can perform a server-side request forgery (SSRF) because the SSRF PROTECTION ENABLED variable is set to false by default. This allows the 'import-from-URL' endpoint to fetch any caller-supplied URL, including internal loopback addresses, enabling access to internal services, cloud metadata endpoints, and other resources not intended for external access.

Recommendations Update HumanSignal Label Studio to a version later than 1.24.0.dev0. Set the SSRF PROTECTION ENABLED variable to true to enable protection.