CVE-2026-59095: LobeChat SSRF Vulnerability Allows Authenticated Credential Disclosure

Technical summary

The vulnerability exists in LobeChat's importFromUrl and fetchImageFromUrl endpoints, which invoke the global fetch function without applying the project's ssrf-safe-fetch wrapper. An authenticated attacker can supply arbitrary URLs as input, causing the server to issue HTTP requests to internal addresses (e.g., 169.254.169.254 on AWS, GCP metadata services) that would normally be restricted. The lack of URL validation and destination filtering on these code paths allows information disclosure of cloud instance metadata and internal service responses that should remain inaccessible.

Business impact

An insider or low-privilege authenticated user can leverage this vulnerability to discover and exfiltrate sensitive cloud credentials, API keys, and internal service configurations without leaving typical network boundaries. For organizations running LobeChat on cloud infrastructure, successful exploitation can lead to lateral movement, privilege escalation, and further compromise of the cloud environment. The impact is amplified in multi-tenant or shared infrastructure scenarios where metadata endpoints may expose credentials with broad permissions.

Affected systems

LobeChat versions prior to 2.2.10-canary.18 are affected. The vulnerability requires prior authentication, so only users with valid LobeChat accounts can exploit it. Organizations should verify their deployed version against the vendor's release notes to confirm exposure.

Exploitability

Exploitation requires valid authentication credentials to access LobeChat. Once authenticated, the attack is trivial—an attacker simply crafts a request to one of the two vulnerable endpoints with an internal URL (such as a cloud metadata endpoint). No user interaction is required, and the attack succeeds in typical cloud-hosted deployments where metadata endpoints are accessible from the application server. The barrier to entry is low for any authenticated user with knowledge of the application's endpoints.

Remediation

Upgrade LobeChat to version 2.2.10-canary.18 or later. Organizations should prioritize this patch given the HIGH severity rating and the ease of exploitation by authenticated users. Verify the installed version in your deployment and apply updates through your standard release management process.

Patch guidance

Apply the vendor's patch by upgrading to LobeChat 2.2.10-canary.18 or a subsequent stable release. Canary releases should be evaluated for stability in your environment before production deployment; if a stable release is available, prefer that. Review your LobeChat deployment logs for evidence of exploitation (e.g., unusual requests to importFromUrl or fetchImageFromUrl endpoints with internal IP addresses or metadata endpoints) prior to patching.

Detection guidance

Monitor HTTP request logs on LobeChat application servers for requests to the importFromUrl and fetchImageFromUrl endpoints that contain suspicious or internal-facing URLs (IP addresses in RFC 1918 ranges, cloud metadata endpoints like 169.254.169.254, localhost addresses, or internal DNS names). Log the request payloads and originating user accounts. Implement network-level egress controls to restrict outbound connections from application servers to cloud metadata endpoints unless explicitly required. Enable audit logging for authenticated user actions involving URL imports.

Why prioritize this

This vulnerability merits HIGH priority due to the combination of a HIGH CVSS score (7.7), trivial exploitability for any authenticated user, direct exposure of cloud credentials and internal service metadata, and the scoped impact across cloud infrastructure. While exploitation requires authentication, insider threats and compromised low-privilege accounts represent realistic attack vectors in many organizations.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects a network-accessible vulnerability requiring low privileges (authenticated user) and low attack complexity, with high confidentiality impact and cross-scope implications. The score does not account for the sensitive nature of cloud credential exposure; organizations hosting LobeChat in cloud environments should weight this vulnerability higher based on their own risk tolerances and asset criticality.

Frequently asked questions