buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Advisories

buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Severity: medium
Date: 11/5/2026
Affecting: buku <= 5.1.1
CVE: CVE-2026-123201
CWE: CWE-918 Server-Side Request Forgery (SSRF)
CVSS: 6.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
References: https://github.com/jarun/buku/issues/910
https://github.com/jarun/buku/pull/916
https://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675
https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105
https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084
Credit: George Chen, LeXofLeviafan
Description: Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo