# CVE-2025-24979: LF Edge eKuiper SSRF in external service registration

Source: https://junglewise.ai/threats/cve-2025-24979-lf-edge-ekuiper-ssrf-in-external-service-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-24979 · Severity: medium · CVSS 5.5 · Published 2026-09-09

eKuiper is a lightweight edge-based streaming data processing platform used to process IoT sensor data and metrics. Prior to version 2.4.0, the application failed to validate the destination addresses of registered external HTTP services, allowing an authenticated administrator to configure the server to make requests to internal network addresses (such as localhost or private cloud metadata endpoints). An attacker with administrative access could use this flaw to probe internal networks, leak credentials, or interact with internal APIs that should not be accessible.

Technologies: [github.com/lf-edge/ekuiper (Go)](https://junglewise.ai/threats/technologies/github-com-lf-edge-ekuiper), [github.com/lf-edge/ekuiper/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-lf-edge-ekuiper-v2), [LF Edge eKuiper](https://junglewise.ai/threats/technologies/ekuiper). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [LF Edge](https://junglewise.ai/threats/vendors/lf-edge).

## Quick answers

**Is CVE-2025-24979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-24979 being exploited in the wild.

**How severe is CVE-2025-24979?** Medium severity, with a CVSS score of 5.5, published 9 September 2026.

**Which products and versions are affected?** github.com/lf-edge/ekuiper (Go) SEMVER:introduced=0; github.com/lf-edge/ekuiper/v2 (Go) < 2.4.0, SEMVER:introduced=0,fixed=2.4.0; LF Edge eKuiper < 2.4.0.

**Is there a fix for CVE-2025-24979?** Yes. github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-24979 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-24979?** Check whether you run github.com/lf-edge/ekuiper (Go), github.com/lf-edge/ekuiper/v2 (Go) or LF Edge eKuiper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/lf-edge/ekuiper/v2 (Go): upgrade to 2.4.0 or later

  ```sh
  go get github.com/lf-edge/ekuiper/v2@v2.4.0
  ```


## Technical details

This is a server-side request forgery (SSRF) vulnerability affecting the external service registration mechanism in eKuiper versions prior to 2.4.0. The root cause is absent IP address validation on HTTP service destinations. An attacker with management API access (typically a privileged user or administrator) can register an external REST service pointing to private IPv4 addresses (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local (169.254.0.0/16), loopback, multicast, or cloud metadata endpoints (169.254.169.254). When a stream processing rule invokes a service function referencing that malicious service, eKuiper will make the HTTP request on behalf of the attacker, returning the response to the rule's sink or for inspection. The attack requires valid credentials to access the eKuiper management API (port 9081), limiting impact to insider threats or compromised administrator accounts. Patched in v2.4.0 via integration of SSRF protection (`httpx.GetSSRFDialContext`) that blocks requests to private and reserved address ranges by default. The patch can be configured via `basic.enablePrivateNet` in kuiper.yaml if legitimate internal communication is required.

## Affected products

- LF Edge eKuiper < 2.4.0

## Identifiers

- CVE-2025-24979
- GHSA-pqqc-8v73-9gg2
- GO-2026-6447

## Timeline

- 2026-09-01: disclosed
- 2026-09-09: advisory
- 2026-09-01: patched: v2.4.0 released with SSRF protection enabled by default

## References

- [https://api.github.com/users/TheMostKnown](https://api.github.com/users/TheMostKnown)
- [https://github.com/TheMostKnown](https://github.com/TheMostKnown)
- [https://api.github.com/users/TheMostKnown/gists%7B/gist_id%7D](https://api.github.com/users/TheMostKnown/gists%7B/gist_id%7D)
- [https://api.github.com/users/TheMostKnown/repos](https://api.github.com/users/TheMostKnown/repos)
- [https://avatars.githubusercontent.com/u/65551462?v=4](https://avatars.githubusercontent.com/u/65551462?v=4)
- [https://api.github.com/users/TheMostKnown/events%7B/privacy%7D](https://api.github.com/users/TheMostKnown/events%7B/privacy%7D)

## Related threats

- [LF Edge eKuiper path traversal in plugin installation](https://junglewise.ai/threats/cve-2025-58363-lf-edge-ekuiper-path-traversal-in-plugin-installation)
- [LF Edge eKuiper stored XSS in external service creation](https://junglewise.ai/threats/cve-2025-24978-lf-edge-ekuiper-stored-xss-in-external-service-creation)
- [GO-2025-4158 - LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction in…](https://junglewise.ai/threats/go-2025-4158-lf-edge-ekuiper-is-vulnerable-to-arbitrary-file-read-write-89ee8418)
- [LF Edge eKuiper is vulnerable to Arbitrary File Read/Write via unsanitized names and zip extraction](https://junglewise.ai/threats/lf-edge-ekuiper-is-vulnerable-to-arbitrary-file-read-write-via-6fdf2ea9)
- [GO-2025-3827 - eKuiper API endpoints handling SQL queries with user-controlled table names. in github.com/lf-edge/ekuiper](https://junglewise.ai/threats/cve-2025-54379-pysec-2025-241-lf-edge-ekuiper-is-a-lightweight-iot-data)