Critical SSRF Vulnerability Discovered in stoatchat Versions Below 0.13.5
A critical server-side request forgery vulnerability in stoatchat allows unauthenticated attackers to access internal network infrastructure.
A critical security vulnerability, tracked as CVE-2026-63306, has been identified in stoatchat versions prior to 0.13.5. The flaw exists within the /proxy and /embed endpoints, which fail to implement proper DNS resolution filtering or private IP range validation when processing user-supplied URLs.
This server-side request forgery vulnerability allows unauthenticated attackers to supply malicious URLs to the affected endpoints. By leveraging this flaw, unauthorized actors can enumerate internal services, fingerprint applications, and reach sensitive instance metadata endpoints, potentially exposing internal infrastructure.
With a CVSS score of 8.6, this vulnerability is classified as critical. Users are advised to update to version 0.13.5 or later to mitigate the risk of unauthorized access to internal systems.
Sources
- GitHub Security Advisories Original source
Continue Reading
SecurityNewA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.