CVE-2026-76164

Name of the Vulnerable Software and Affected Versions AIL Framework (affected versions not specified)

Description A server-side request forgery (SSRF) issue exists in the crawler submission functionality. A low-privileged authenticated user can submit arbitrary URLs for crawling due to insufficient validation of the destination host. This allows the crawler to make direct HTTP(S) requests to restricted addresses, such as loopback addresses, RFC1918 private networks, link-local addresses, and cloud metadata services like 169.254.169.254. Manual crawler tasks bypass the domain blacklist because they are assigned a non-zero priority, and IP literals are fetched directly instead of using a proxy. An attacker can use the server as a network pivot to access internal services. Since the crawler interface provides access to the resulting HTML, screenshots, and HAR data, the SSRF is non-blind, potentially leading to the disclosure of sensitive internal data, service information, or cloud instance credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.