Is CVE-2026-110610 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110610 being exploited in the wild.

How severe is CVE-2026-110610?

Medium severity, with a CVSS score of 5.4, published 14 October 2026.

Which products and versions are affected?

YunaiV Ruoyi-Vue-Pro through 2026.09.

Is there a fix for CVE-2026-110610?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-110610 attacked?

It is attacked over the network.

Am I affected by CVE-2026-110610?

Check whether you run YunaiV Ruoyi-Vue-Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110610: ruoyi-vue-pro server-side request forgery in AI image service

CVE-2026-110610 · Severity: medium · CVSS 5.4 · Published 2026-10-14

ruoyi-vue-pro is a web application framework that includes an AI image generation service. The vulnerability allows authenticated users to make the server fetch arbitrary URLs, potentially exposing internal services, cloud metadata endpoints, and private network resources. An attacker could probe or compromise infrastructure by forcing the server to make requests to sensitive internal addresses.

Technologies: YunaiV Ruoyi-Vue-Pro. Vendors: YunaiV.

Quick answers

Is CVE-2026-110610 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110610 being exploited in the wild.
How severe is CVE-2026-110610?: Medium severity, with a CVSS score of 5.4, published 14 October 2026.
Which products and versions are affected?: YunaiV Ruoyi-Vue-Pro through 2026.09.
Is there a fix for CVE-2026-110610?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-110610 attacked?: It is attacked over the network.
Am I affected by CVE-2026-110610?: Check whether you run YunaiV Ruoyi-Vue-Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability in the yudao-module-ai image service allows authenticated users to trigger arbitrary HTTP requests by supplying a malicious referImageUrl parameter to the Midjourney imagine endpoint. The vulnerable code uses Hutool's HttpUtil.downloadBytes() to fetch the image without proper URL validation, enabling attackers to reach loopback (127.0.0.1), private network ranges (10.x.x.x, 192.168.x.x), or cloud metadata endpoints (169.254.169.254). No authentication bypass is required; attackers must already have valid credentials.

Affected products

YunaiV ruoyi-vue-pro through 2026.09

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.