# CVE-2026-109189: fit2cloud MeterSphere server-side request forgery in Swagger3 Parser

Source: https://junglewise.ai/threats/cve-2026-109189-a-vulnerability-was-detected-in-fit2cloud-metersphere-up-to-3-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109189 · Severity: medium · CVSS 6.3 · Published 2026-10-13

fit2cloud MeterSphere is an API testing and performance monitoring platform used by enterprises. A server-side request forgery vulnerability in the Swagger3 Parser component allows an unauthenticated attacker to manipulate API definition URLs and force the server to make arbitrary network requests, potentially accessing internal systems or sensitive data.

Vendors: [Fit2cloud](https://junglewise.ai/threats/vendors/fit2cloud).

## Quick answers

**Is CVE-2026-109189 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109189 being exploited in the wild.

**How severe is CVE-2026-109189?** Medium severity, with a CVSS score of 6.3, published 13 October 2026.

**Which products and versions are affected?** Fit2cloud MeterSphere up to 3.6.9-lts.

**Is there a fix for CVE-2026-109189?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109189 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109189?** Check whether you run Fit2cloud MeterSphere at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Swagger3ParserApiDefinition.testUrlTimeout function, which fails to properly validate the swaggerUrl parameter before using it in server-side requests. An attacker can supply a malicious URL that causes the MeterSphere server to make requests to internal or external systems. The attack requires no authentication and is exploitable remotely.

## Affected products

- fit2cloud MeterSphere up to 3.6.9-lts

## Timeline

- 2026-10-13: disclosed
- other: Exploit is public

## References

- [https://vuldb.com/cve/CVE-2026-109189](https://vuldb.com/cve/CVE-2026-109189)
- [https://vuldb.com/submit/979788](https://vuldb.com/submit/979788)