CVE-2026-108523: Studio-Saelix Sencho server-side request forgery in git-sources endpoint

CVE-2026-108523 · Severity: medium · CVSS 4.3 · Published 2026-10-11

Sencho is a self-hosted Docker Compose management platform. An authenticated administrator can manipulate the git repository URL parameter to make the backend server connect to internal network addresses, including loopback and private IP ranges, bypassing URL scheme validation. This allows reconnaissance of internal services and potential pivoting to cloud metadata endpoints or other internal systems.

Technologies: Studio-Saelix Sencho. Vendors: Studio-Saelix.

Quick answers

Is CVE-2026-108523 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108523 being exploited in the wild.
How severe is CVE-2026-108523?
Medium severity, with a CVSS score of 4.3, published 11 October 2026.
Which products and versions are affected?
Studio-Saelix Sencho up to 0.94.1.
Is there a fix for CVE-2026-108523?
No fixed version is recorded yet. Implement host and IP validation for the /api/git-sources/browse endpoint: resolve hostnames before connecting, block loopback (127.0.0.1), link-local, RFC1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and metadata service addresses (169.254.169.254); re-validate the resolved address at connection time and disable redirect following. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108523 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-108523?
Check whether you run Studio-Saelix Sencho at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Implement host and IP validation for the /api/git-sources/browse endpoint: resolve hostnames before connecting, block loopback (127.0.0.1), link-local, RFC1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and metadata service addresses (169.254.169.254); re-validate the resolved address at connection time and disable redirect following.

Technical details

The POST /api/git-sources/browse endpoint in outboundTarget.ts validates only the URL scheme (requires https://) but fails to validate the target host or IP address. An authenticated attacker can send requests to arbitrary internal IPs, loopback addresses, and RFC1918 ranges; response timing and error messages leak information about port state and service availability. The vulnerability requires authentication and network access to the Sencho API endpoint.

Affected products

  • Studio-Saelix Sencho up to 0.94.1

Timeline

  • 2026-07-16: disclosed: Vulnerability published via GitHub Gist
  • 2026-10-11: advisory: CVE-2026-108523 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.