Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read

Atlassian: DNS-rebinding TOCTOU bypass of the SSRF

Atlassian: Incomplete fix for GHSA-7r34-79r5-rcc9: redirect-based SSRF via unhooked requests session in Jira user-permission lookup

Open WebUI Vulnerable to SSRF via OAuth Profile Picture URL in _process_picture_url (oauth.py

Flowise: SSRF Protection Bypass via Unprotected Built-in HTTP Modules in Custom Function Sandbox

Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers

9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

Budibase: SSRF via DNS rebinding in the REST datasource integration

Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure

SiYuan Agent Tools SSRF via DNS-Rebinding TOCTOU (Bypass of CheckHostSSRF

PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposite content passed to it, enabling any request

aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete

mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image

before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using

before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF protection bypass in the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests

PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url parameter

praisonaiagents: SSRF guard validates literal IPs only and never resolves