CVE-2026-85179: Label Studio: SSRF via webhooks hits cloud metadata

HIGHPoC AVAILABLECISA: TRACK*

Published September 3, 2026

CISO Take

Label Studio (through 1.23.0) does not validate webhook destination URLs, so any authenticated user — even a low-privileged one — can point a webhook at internal RFC 1918 addresses or the cloud instance metadata service and enable payload transmission on outbound calls. This is a classic SSRF chained into a data annotation platform: with CVSS 8.5 (confidentiality-high, network, low complexity, no user interaction beyond auth) the theoretical severity is high, but exploitation likelihood right now looks low — there's no EPSS score, it's not in CISA KEV, no public exploit or Nuclei template exists, and downstream dependents are limited to 2 packages. The real risk is architectural: Label Studio instances are frequently deployed inside cloud VPCs with IAM roles attached for training-data storage access, and metadata-endpoint SSRF is the textbook path to stealing those credentials. Patch to the fixed release referenced in the HumanSignal commit, and in the meantime block egress from the Label Studio host to 169.254.169.254 and private CIDR ranges, and enforce IMDSv2 with a hop limit of 1 on any cloud instance running it.

Sources:NVDGitHub AdvisoryATLASvulncheck.com

What is the risk?

High theoretical severity (CVSS 8.5, AV:N/AC:L/PR:L/UI:N, scope-changed confidentiality-high) but currently low observed exploitation pressure: no EPSS percentile available, absent from CISA KEV, no public PoC or Nuclei template detected, and the affected package has a modest downstream footprint (2 known dependents). Requires only low-privilege authenticated access — a common bar for internal tools like annotation platforms where many users hold standard accounts — which meaningfully lowers the practical barrier versus an unauthenticated bug. Given SSRF-to-cloud-metadata is a well-understood, high-value technique for credential theft, this should be treated as a priority patch even without active-exploitation evidence.

How does the attack unfold?

Webhook Creation

An authenticated low-privileged user configures a Label Studio webhook pointing to an internal RFC 1918 address or the cloud metadata endpoint, enabling payload transmission.

SSRF Trigger

Label Studio's server dispatches the webhook on a routine event, issuing the outbound HTTP request to the attacker-chosen internal target on the server's behalf.

Credential/Data Exposure

The internal service or metadata endpoint responds with sensitive data — IAM credentials or internal annotation data — which gets logged or relayed in the webhook delivery.

AML.T0055

Exfiltration

The attacker retrieves the captured credentials or data from the webhook logs/receiver, completing exfiltration and potentially pivoting further into cloud infrastructure.

AML.T0025

Webhook Creation

An authenticated low-privileged user configures a Label Studio webhook pointing to an internal RFC 1918 address or the cloud metadata endpoint, enabling payload transmission.

SSRF Trigger

Label Studio's server dispatches the webhook on a routine event, issuing the outbound HTTP request to the attacker-chosen internal target on the server's behalf.

Credential/Data Exposure

The internal service or metadata endpoint responds with sensitive data — IAM credentials or internal annotation data — which gets logged or relayed in the webhook delivery.

AML.T0055

Exfiltration

The attacker retrieves the captured credentials or data from the webhook logs/receiver, completing exfiltration and potentially pivoting further into cloud infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Label Studio	pip	—	No patch
28.6K2 dependentsPushed yesterday50% patched~275d to patchFull package profile →

Do you use Label Studio? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Patch to the version containing the fix referenced in commit 2c1c1d6 on the HumanSignal/label-studio repo (verify the fixed release number against the vendor advisory). 2) Until patched, restrict egress from the Label Studio host/container at the network layer — deny outbound traffic to RFC 1918 ranges and 169.254.169.254 except where explicitly required. 3) Enforce IMDSv2 with hop-limit 1 on cloud instances so a server-side request can't reach the metadata service even if SSRF succeeds. 4) Restrict webhook-creation privileges to admin roles only, rather than all authenticated users, as an interim compensating control. 5) Monitor for webhook configuration changes and unusual outbound requests from the Label Studio host (e.g., requests to internal IP ranges or metadata IPs) via egress logging/WAF alerts.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data LeakageData ExtractionTraining DataFrameworkAML.T0025- Exfiltration via Cyber Means AML.T0036- Data from Information Repositories AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-Data for AI systems

NIST AI RMF

MANAGE-4.1-Risk treatment for identified AI system vulnerabilities

Frequently Asked Questions

What is CVE-2026-85179?

Is CVE-2026-85179 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-85179, increasing the risk of exploitation.

How to fix CVE-2026-85179?

1) Patch to the version containing the fix referenced in commit 2c1c1d6 on the HumanSignal/label-studio repo (verify the fixed release number against the vendor advisory). 2) Until patched, restrict egress from the Label Studio host/container at the network layer — deny outbound traffic to RFC 1918 ranges and 169.254.169.254 except where explicitly required. 3) Enforce IMDSv2 with hop-limit 1 on cloud instances so a server-side request can't reach the metadata service even if SSRF succeeds. 4) Restrict webhook-creation privileges to admin roles only, rather than all authenticated users, as an interim compensating control. 5) Monitor for webhook configuration changes and unusual outbound requests from the Label Studio host (e.g., requests to internal IP ranges or metadata IPs) via egress logging/WAF alerts.

What systems are affected by CVE-2026-85179?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, data annotation pipelines, MLOps pipelines.

What is the CVSS score for CVE-2026-85179?

CVE-2026-85179 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

training pipelinesdata annotation pipelinesMLOps pipelines

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0036Data from Information Repositories

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

Exploitation Scenario

An attacker with a standard (low-privilege) Label Studio account creates a new webhook, sets the target URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/<role-name>, and enables 'send payload' on the outbound request. When the webhook fires on a routine annotation event, the Label Studio server issues the HTTP request on the attacker's behalf, and the response — containing temporary IAM credentials or, if targeted at an internal service instead, sensitive annotation/training data — is captured in the webhook delivery log or forwarded to an attacker-controlled receiver, giving the attacker a foothold to pivot into the surrounding cloud environment or directly exfiltrate labeled datasets.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.