CVE-2026-76164

{
  "id": "CVE-2026-76164",
  "sourceIdentifier": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
  "published": "2026-08-19T09:17:36.830",
  "lastModified": "2026-10-22T16:09:59.560",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host.\n\n\nThe crawler can therefore be instructed to make direct HTTP(S) requests to addresses that should not be reachable by application users, including loopback addresses, RFC1918 private networks, link-local addresses, and cloud metadata services such as 169.254.169.254.\n\n\nManual crawler tasks bypass the existing domain blacklist because they are assigned a non-zero priority, and ordinary IP literals are classified as web targets and fetched directly rather than through Tor or another proxy. Consequently, an attacker can use the AIL server as a network pivot to access services available from the server's network context.\n\n\nResponses generated by these requests, including captured HTML, screenshots, and HAR data, can subsequently be accessed through the crawler interface. This makes the SSRF non-blind and may allow an attacker to disclose sensitive internal application data, service information, or cloud instance metadata and credentials.\n\n\nThe patch introduces validation that resolves crawler destinations and rejects URLs resolving to non-global IP addresses, addressing localhost, private-network, and link-local targets."
    },
    {
      "lang": "es",
      "value": "AIL Framework contiene una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en su funcionalidad de envío del rastreador. Un usuario autenticado con bajos privilegios con acceso a la interfaz del rastreador puede enviar una URL arbitraria para rastrear sin una validación adecuada del host de destino.\n\nPor lo tanto, se puede instruir al rastreador para que realice peticiones HTTP(S) directas a direcciones que no deberían ser accesibles por los usuarios de la aplicación, incluyendo direcciones de bucle invertido, redes privadas RFC1918, direcciones de enlace local y servicios de metadatos en la nube como 169.254.169.254.\n\nLas tareas manuales del rastreador eluden la lista negra de dominios existente porque se les asigna una prioridad distinta de cero, y los literales IP ordinarios se clasifican como objetivos web y se obtienen directamente en lugar de a través de Tor u otro proxy. En consecuencia, un atacante puede usar el servidor AIL como un pivote de red para acceder a servicios disponibles desde el contexto de red del servidor.\n\nLas respuestas generadas por estas peticiones, incluyendo HTML capturado, capturas de pantalla y datos HAR, pueden ser accedidas posteriormente a través de la interfaz del rastreador. Esto hace que la SSRF no sea ciega y puede permitir a un atacante divulgar datos internos sensibles de la aplicación, información del servicio o metadatos y credenciales de instancias en la nube.\n\nEl parche introduce una validación que resuelve los destinos del rastreador y rechaza las URL que resuelven a direcciones IP no globales, abordando objetivos de localhost, red privada y enlace local."
    }
  ],
  "affected": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "affectedData": [
        {
          "vendor": "ail-project",
          "product": "ail-framework",
          "defaultStatus": "unaffected",
          "repo": "https://github.com/ail-project/ail-framework/",
          "versions": [
            {
              "version": "0",
              "lessThan": "7.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T15:44:36.357134Z",
          "id": "CVE-2026-76164",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ail-project/ail-framework/commit/d7b60ff9e20ee493895430b1a7c63d498a8fd780",
      "source": "5a6e4751-2f3f-4070-9419-94fb35b644e8"
    }
  ]
}