PT-2026-8308

CVE-2026-2532

Published

2026-02-16

Updated

2026-02-16

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lintsinghua DeepAudit versions up to 3.0.3

Description A server-side request forgery condition exists in the IP Address Handler component of lintsinghua DeepAudit. The issue is related to unknown processing within the file backend/app/api/v1/endpoints/embedding config.py. Successful exploitation allows for remote initiation of the attack. The affected API endpoint is /api/v1/endpoints/embedding config.

Recommendations Upgrade to version 3.0.4 or 3.1.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Fushuling

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers