CVE-2026-121561: Label Studio: SSRF in export leaks internal data, API token

HIGH

Published November 3, 2026

CISO Take

Label Studio before 1.23.2 (SDK before 2.1.2) has a server-side request forgery flaw in its image-bearing export formats (YOLO/COCO with images), letting any authenticated user make the server fetch internal URLs and return the responses. A spoofed Host header can also be used to capture the organization owner's API token, so a low-privilege annotator account can escalate to full organization control. It is rated high (CVSS 7.7) with a changed scope, which reflects reach into cloud metadata endpoints and internal services behind the data-labeling host. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, and only 2 tracked downstream dependents, so mass exploitation is not expected today. Even so, labeling platforms often hold sensitive training data and sit on privileged cloud networks, and the vendor patch commits are public and easy to reverse-engineer. Upgrade to label-studio 1.23.2 and label-studio-sdk 2.1.2, rotate organization owner API tokens, and restrict egress from the Label Studio host to internal and metadata addresses.

Sources:NVDGitHub AdvisoryATLASVulnCheck

What is the risk?

Overall risk is medium-high. Exploitation is low complexity, network-reachable and needs only low privileges (any authenticated user, including contractor annotators), with no user interaction. Confidentiality impact is high and scope changes, because the vulnerable server pivots into other internal systems such as cloud metadata services, internal APIs and databases. Integrity and availability are unaffected. Token theft raises the real-world impact to administrative takeover of the labeling workspace. Lowering factors: authentication is required, there is no known public exploit or KEV listing, the EPSS score is not available, and the package has few tracked dependents. The project is actively maintained (last push 2026-10-30), but 10 other CVEs in the same package point to a recurring security debt.

How does the attack unfold?

Initial Access

Attacker logs in with a low-privilege or self-registered Label Studio account.

AML.T0012

Exploitation

Attacker imports tasks with data.image pointing at internal URLs and exports as YOLO or COCO with images, making the server fetch them.

AML.T0049

Credential Theft

Attacker spoofs the Host header so the organization owner's API token is sent to a server they control.

AML.T0106

Impact

Attacker uses the owner token to take over the workspace, steal training datasets and cloud storage credentials, or tamper with annotations.

AML.T0091.000

Initial Access

Attacker logs in with a low-privilege or self-registered Label Studio account.

AML.T0012

Exploitation

Attacker imports tasks with data.image pointing at internal URLs and exports as YOLO or COCO with images, making the server fetch them.

AML.T0049

Credential Theft

Attacker spoofs the Host header so the organization owner's API token is sent to a server they control.

AML.T0106

Impact

Attacker uses the owner token to take over the workspace, steal training datasets and cloud storage credentials, or tamper with annotations.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Label Studio	pip	—	No patch
28.6K2 dependentsPushed 3d ago42% patched~275d to patchFull package profile →
Label Studio	pip	—	No patch
28.6K2 dependentsPushed 3d ago42% patched~275d to patchFull package profile →

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

INone

ANone

What should I do?

6 steps

Upgrade label-studio to 1.23.2 or later and label-studio-sdk to 2.1.2 or later.
Rotate the API tokens of organization owners and admins, and review recent token usage.
Until patched, disable or restrict YOLO/COCO-with-images export for non-admin roles and limit account creation to trusted users.
Enforce network egress controls so the Label Studio host cannot reach internal ranges, link-local metadata endpoints (169.254.169.254) or sensitive services; require IMDSv2 on cloud hosts.
Set a fixed allowed hosts configuration and have the reverse proxy reject unexpected Host headers.
Detect: look for tasks whose data.image points to internal IPs, localhost or metadata hostnames, for export jobs that follow such imports, for requests with mismatched Host headers, and for unusual API calls using owner tokens from new IPs.

How is it classified?

Data ExtractionAuth BypassData LeakageFrameworkTraining DataAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0091.000- Application Access Token AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoringA.7.2-Data for development and enhancement of AI system

NIST AI RMF

GOVERN 6.1-Policies for third-party AI and software risksMANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-121561?

Is CVE-2026-121561 actively exploited?

No confirmed active exploitation of CVE-2026-121561 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-121561?

1. Upgrade label-studio to 1.23.2 or later and label-studio-sdk to 2.1.2 or later. 2. Rotate the API tokens of organization owners and admins, and review recent token usage. 3. Until patched, disable or restrict YOLO/COCO-with-images export for non-admin roles and limit account creation to trusted users. 4. Enforce network egress controls so the Label Studio host cannot reach internal ranges, link-local metadata endpoints (169.254.169.254) or sensitive services; require IMDSv2 on cloud hosts. 5. Set a fixed allowed hosts configuration and have the reverse proxy reject unexpected Host headers. 6. Detect: look for tasks whose data.image points to internal IPs, localhost or metadata hostnames, for export jobs that follow such imports, for requests with mismatched Host headers, and for unusual API calls using owner tokens from new IPs.

What systems are affected by CVE-2026-121561?

This vulnerability affects the following AI/ML architecture patterns: Data labeling and annotation platforms, Training data pipelines, MLOps tooling, Self-hosted AI development environments.

What is the CVSS score for CVE-2026-121561?

CVE-2026-121561 has a CVSS v3.1 base score of 7.7 (HIGH).

What is the AI security impact?

Affected AI Architectures

Data labeling and annotation platformsTraining data pipelinesMLOps toolingSelf-hosted AI development environments

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0091.000Application Access Token

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6, A.7.2

NIST AI RMF: GOVERN 6.1, MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.

Exploitation Scenario

An attacker with a low-privilege annotator account (or a self-registered account on an exposed instance) imports tasks whose data.image fields point to internal services such as the cloud metadata endpoint or an internal MLflow or model-serving API. They then export the project as YOLO or COCO with images, and the server fetches each URL and packages the responses into the downloadable archive, exposing internal data. In a second step, they spoof the Host header so the server-side fetch sends the organization owner's API token to an attacker-controlled host. With that token they access all projects, pull sensitive training datasets, modify annotations to poison labels, or use stored cloud storage credentials to reach the underlying buckets.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.