Is CVE-2026-101048 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101048 being exploited in the wild.

How severe is CVE-2026-101048?

Medium severity, with a CVSS score of 5.4, published 27 September 2026.

Is there a fix for CVE-2026-101048?

A patch was published on 2026-07-23: Fixed in version 4.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101048 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-101048?

Check whether you run Cloudreve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101048: Cloudreve authorization bypass in admin node test endpoints

CVE-2026-101048 · Severity: medium · CVSS 5.4 · Published 2026-09-27

Cloudreve is a self-hosted cloud storage platform that manages file storage nodes. Before version 4.17.0, two administrative endpoints for testing node connectivity fail to enforce proper authorization checks, allowing an attacker with limited admin read-only credentials to trigger outbound network requests to arbitrary destinations. This enables server-side request forgery attacks that can probe internal networks, access internal services, or deliver malicious requests to attacker-controlled endpoints.

Technologies: Cloudreve. Vendors: Cloudreve.

Quick answers

Is CVE-2026-101048 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101048 being exploited in the wild.
How severe is CVE-2026-101048?: Medium severity, with a CVSS score of 5.4, published 27 September 2026.
Which products and versions are affected?: Cloudreve before 4.17.0.
Is there a fix for CVE-2026-101048?: A patch was published on 2026-07-23: Fixed in version 4.17.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101048 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-101048?: Check whether you run Cloudreve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader endpoints execute network operations using attacker-supplied node configuration but enforce only the Admin.Read OAuth scope instead of Admin.Write. An authenticated OAuth client with Admin.Read authorization can submit arbitrary node definitions and trigger TestNodeService.Test() to send requests to attacker-controlled URLs, resulting in blind SSRF. The root cause is incomplete scope enforcement on side-effect-generating endpoints in the admin route group.

Affected products

Cloudreve Cloudreve before 4.17.0

Timeline

2026-07-23: disclosed
2026-07-23: patched: Fixed in version 4.17.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.