Security Advisory

CVE-2026-85179

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-03 14:12:18

Last updated 2026-09-05 01:22:21

Assigner VulnCheck

CVSS score 8.5

State PUBLISHED

Description

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

← Browse all CVEs View on cve.org ↗