CVE-2022-36551: Label Studio: SSRF + file read, self-reg bypass

Q: Is CVE-2022-36551 actively exploited?

A working exploit for CVE-2022-36551 is published in Exploit-DB, increasing the risk of exploitation.

Q: How to fix CVE-2022-36551?

1. PATCH: Upgrade to label-studio >= 1.6.0 immediately — this is the only complete fix. 2. DISABLE self-registration if running <1.6.0: set LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK=1 or restrict via reverse proxy. 3. NETWORK: Place Label Studio behind VPN or IP allowlist; it should never be publicly accessible without authentication. 4. DETECT: Search access logs for Data Import requests containing 'file://', '169.254.169.254', '127.0.0.1', or internal RFC-1918 ranges in URL parameters. 5. ROTATE: If instance was exposed, rotate all credentials stored in config files, environment variables, and connected cloud accounts. 6. AUDIT: Review all Data Import history for suspicious file:// or internal URLs.

Q: What systems are affected by CVE-2022-36551?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data labeling platforms, MLOps infrastructure.

Q: What is the CVSS score for CVE-2022-36551?

CVE-2022-36551 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 6.89%.

GHSA-pc6f-259w-w3j6MEDIUMPoC AVAILABLE

Published October 4, 2022

CISO Take

Any internet-exposed Label Studio instance running <1.6.0 is trivially exploitable — self-registration is on by default, so an unauthenticated attacker can register, then use the Data Import SSRF to read arbitrary files including credentials, model artifacts, and cloud metadata endpoints. Patch to 1.6.0 immediately and audit access logs for unexpected import requests. If patching is not immediate, disable self-registration and restrict Data Import to trusted users.

What is the risk?

Effective risk is higher than the CVSS 6.5 Medium suggests. The self-registration default turns this from an authenticated vulnerability into a de facto unauthenticated one for any publicly reachable instance. SSRF + arbitrary file read in an ML annotation platform gives attackers access to training datasets, labeling credentials, cloud provider metadata (AWS IMDS, GCP metadata), and internal network pivoting. EPSS of 0.047 reflects low automated exploitation activity, but the exploit primitive is trivial to reproduce manually.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Label Studio	pip	< 1.6.0	`1.6.0`
28.6K2 dependentsPushed 6d ago42% patched~275d to patchFull package profile →

Do you use Label Studio? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

6.9%

chance of exploitation in 30 days

Higher than 94% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○Exploit published in Exploit-DB

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

6 steps

PATCH
Upgrade to label-studio >= 1.6.0 immediately — this is the only complete fix.
DISABLE self-registration if running <1.6.0: set LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK=1 or restrict via reverse proxy.
NETWORK
Place Label Studio behind VPN or IP allowlist; it should never be publicly accessible without authentication.
DETECT
Search access logs for Data Import requests containing 'file://', '169.254.169.254', '127.0.0.1', or internal RFC-1918 ranges in URL parameters.
ROTATE
If instance was exposed, rotate all credentials stored in config files, environment variables, and connected cloud accounts.
AUDIT
Review all Data Import history for suspicious file:// or internal URLs.

How is it classified?

Data ExtractionAuth BypassData LeakageTraining DataFrameworkAML.T0021- Establish Accounts AML.T0025- Exfiltration via Cyber Means AML.T0035- AI Artifact Collection AML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 10-Data and Data GovernanceArticle 9-Risk Management System

ISO 42001

A.8.2-Data Security in AI LifecycleA.9.2-Access Control for AI Systems

NIST AI RMF

MANAGE 2.4-Residual risks and negative impacts are managedMAP 1.5-Organizational risk tolerance and context

OWASP LLM Top 10

LLM03-Training Data Poisoning

Frequently Asked Questions

What is CVE-2022-36551?

Is CVE-2022-36551 actively exploited?

A working exploit for CVE-2022-36551 is published in Exploit-DB, increasing the risk of exploitation.

How to fix CVE-2022-36551?

1. PATCH: Upgrade to label-studio >= 1.6.0 immediately — this is the only complete fix. 2. DISABLE self-registration if running <1.6.0: set LABEL_STUDIO_DISABLE_SIGNUP_WITHOUT_LINK=1 or restrict via reverse proxy. 3. NETWORK: Place Label Studio behind VPN or IP allowlist; it should never be publicly accessible without authentication. 4. DETECT: Search access logs for Data Import requests containing 'file://', '169.254.169.254', '127.0.0.1', or internal RFC-1918 ranges in URL parameters. 5. ROTATE: If instance was exposed, rotate all credentials stored in config files, environment variables, and connected cloud accounts. 6. AUDIT: Review all Data Import history for suspicious file:// or internal URLs.

What systems are affected by CVE-2022-36551?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data labeling platforms, MLOps infrastructure.

What is the CVSS score for CVE-2022-36551?

CVE-2022-36551 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 6.89%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata labeling platformsMLOps infrastructure

MITRE ATLAS Techniques

AML.T0021Establish Accounts

AML.T0025Exfiltration via Cyber Means

AML.T0035AI Artifact Collection

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 10, Article 9

ISO 42001: A.8.2, A.9.2

NIST AI RMF: MANAGE 2.4, MAP 1.5

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF. This issue is fixed in version 1.6.0.

Exploitation Scenario

Attacker discovers a Label Studio instance via Shodan/Censys. Self-registration is enabled (default). Attacker registers a free account. Using the Data Import feature, attacker submits a crafted import request pointing to 'file:///etc/passwd' or 'http://169.254.169.254/latest/meta-data/iam/security-credentials/' to harvest AWS instance role credentials. With cloud credentials, attacker pivots to S3 buckets containing training datasets, potentially exfiltrating proprietary labeled data or injecting poisoned samples. If the instance runs with broad IAM permissions (common in ML environments), full cloud account compromise is achievable from a single SSRF request.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)Primary

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.