CVE-2026-92566

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 6.0.1

Description An issue exists where unauthenticated attackers can execute arbitrary HTTP requests by providing a caller-controlled URI. This occurs via the '/dataSet/preview/Http' endpoint, allowing the issuance of GET, POST, PUT, PATCH, or DELETE requests to internal endpoints and cloud metadata services. The attacker can receive full response bodies without authentication or validation. This is a server-side request forgery (SSRF), which is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update DataGear to a version newer than 6.0.0. Restrict access to the '/dataSet/preview/Http' endpoint to minimize the risk of exploitation.