CVE-2026-8712

Name of the Vulnerable Software and Affected Versions Wyoming versions prior to 1.10.2

Description An issue allows unauthenticated attackers with network access to perform server-side request forgery (SSRF), a technique where an attacker forces a server to make requests to an unintended location. By providing a malicious uri query parameter to the HTTP API, attackers can use tcp:// or unix:// URIs to override the configured backend and redirect connections to arbitrary targets. The affected endpoints include '/api/info', '/api/speech-to-text', and '/api/text-to-speech'.

Recommendations Update to version 1.10.2 or later. Avoid using the uri parameter in the '/api/info', '/api/speech-to-text', and '/api/text-to-speech' endpoints until the update is applied.