Executive brief
eKuiper is a lightweight edge-based streaming data processing platform used to process IoT sensor data and metrics. Prior to version 2.4.0, the application failed to validate the destination addresses of registered external HTTP services, allowing an authenticated administrator to configure the server to make requests to internal network addresses (such as localhost or private cloud metadata endpoints). An attacker with administrative access could use this flaw to probe internal networks, leak credentials, or interact with internal APIs that should not be accessible.
Technical details
This is a server-side request forgery (SSRF) vulnerability affecting the external service registration mechanism in eKuiper versions prior to 2.4.0. The root cause is absent IP address validation on HTTP service destinations. An attacker with management API access (typically a privileged user or administrator) can register an external REST service pointing to private IPv4 addresses (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), loopback, multicast, or cloud metadata endpoints (169.254.169.254). When a stream processing rule invokes a service function referencing that malicious service, eKuiper will make the HTTP request on behalf of the attacker, returning the response to the rule's sink or for inspection. The attack requires valid credentials to access the eKuiper management API (port 9081), limiting impact to insider threats or compromised administrator accounts. Patched in v2.4.0 via integration of SSRF protection (`httpx.GetSSRFDialContext`) that blocks requests to private and reserved address ranges by default. The patch can be configured via `basic.enablePrivateNet` in kuiper.yaml if legitimate internal communication is required.
Affected products
- LF Edge eKuiper < 2.4.0
Timeline
- 2026-09-01: disclosed
- 2026-09-09: advisory
- 2026-09-01: patched: v2.4.0 released with SSRF protection enabled by default