Is CVE-2025-24979 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-24979 being exploited in the wild.

How severe is CVE-2025-24979?

Medium severity, with a CVSS score of 5.5, published 9 September 2026.

Which products and versions are affected?

github.com/lf-edge/ekuiper (Go) SEMVER:introduced=0; github.com/lf-edge/ekuiper/v2 (Go) < 2.4.0, SEMVER:introduced=0,fixed=2.4.0; LF Edge eKuiper < 2.4.0.

Is there a fix for CVE-2025-24979?

Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-24979 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-24979?

Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-24979: LF Edge eKuiper SSRF in external service registration

Q: Is there a fix for CVE-2025-24979?

Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-24979 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-24979?

Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-24979 · Severity: medium · CVSS 5.5 · Published 2026-09-09

eKuiper is a lightweight edge-based streaming data processing platform used to process IoT sensor data and metrics. Prior to version 2.4.0, the application failed to validate the destination addresses of registered external HTTP services, allowing an authenticated administrator to configure the server to make requests to internal network addresses (such as localhost or private cloud metadata endpoints). An attacker with administrative access could use this flaw to probe internal networks, leak credentials, or interact with internal APIs that should not be accessible.

Technologies: github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go), LF Edge eKuiper. Vendors: Go, LF Edge.

Quick answers

Is CVE-2025-24979 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-24979 being exploited in the wild.
How severe is CVE-2025-24979?: Medium severity, with a CVSS score of 5.5, published 9 September 2026.
Which products and versions are affected?: github.com/lf-edge/ekuiper (Go) SEMVER:introduced=0; github.com/lf-edge/ekuiper/v2 (Go) < 2.4.0, SEMVER:introduced=0,fixed=2.4.0; LF Edge eKuiper < 2.4.0.
Is there a fix for CVE-2025-24979?: Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-24979 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-24979?: Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later
```
go get github.com/lf-edge/ekuiper/v2@v2.4.0
```

Technical details

This is a server-side request forgery (SSRF) vulnerability affecting the external service registration mechanism in eKuiper versions prior to 2.4.0. The root cause is absent IP address validation on HTTP service destinations. An attacker with management API access (typically a privileged user or administrator) can register an external REST service pointing to private IPv4 addresses (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), loopback, multicast, or cloud metadata endpoints (169.254.169.254). When a stream processing rule invokes a service function referencing that malicious service, eKuiper will make the HTTP request on behalf of the attacker, returning the response to the rule's sink or for inspection. The attack requires valid credentials to access the eKuiper management API (port 9081), limiting impact to insider threats or compromised administrator accounts. Patched in v2.4.0 via integration of SSRF protection (`httpx.GetSSRFDialContext`) that blocks requests to private and reserved address ranges by default. The patch can be configured via `basic.enablePrivateNet` in kuiper.yaml if legitimate internal communication is required.

Affected products

LF Edge eKuiper < 2.4.0

Identifiers

CVE-2025-24979
GHSA-pqqc-8v73-9gg2
GO-2026-6447

Timeline

2026-09-01: disclosed
2026-09-09: advisory
2026-09-01: patched: v2.4.0 released with SSRF protection enabled by default

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.