Is CVE-2026-41644 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41644 being exploited in the wild.

How severe is CVE-2026-41644?

High severity, with a CVSS score of 7.1, published 7 May 2026.

Which products and versions are affected?

github.com/monetr/monetr (Go) SEMVER:introduced=0,fixed=1.12.5.

Is there a fix for CVE-2026-41644?

Yes. github.com/monetr/monetr (Go): upgrade to 1.12.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41644 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-41644?

Check whether you run github.com/monetr/monetr (Go) or Monetr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41644: monetr SSRF in Lunch Flow integration

CVE-2026-41644 · Severity: high · CVSS 7.1 · Published 2026-05-07

monetr is a budgeting application used to track recurring expenses. A security vulnerability in its Lunch Flow integration allows logged-in users to force the server to make unauthorized requests to internal or external web addresses. This could allow an attacker to scan private internal networks or access sensitive information that is normally protected from the public internet.

Technologies: github.com/monetr/monetr (Go). Vendors: Go.

Quick answers

Is CVE-2026-41644 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41644 being exploited in the wild.
How severe is CVE-2026-41644?: High severity, with a CVSS score of 7.1, published 7 May 2026.
Which products and versions are affected?: github.com/monetr/monetr (Go) SEMVER:introduced=0,fixed=1.12.5.
Is there a fix for CVE-2026-41644?: Yes. github.com/monetr/monetr (Go): upgrade to 1.12.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41644 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-41644?: Check whether you run github.com/monetr/monetr (Go) or Monetr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/monetr/monetr (Go): upgrade to 1.12.5 or later
```
go get github.com/monetr/monetr@v1.12.5
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Lunch Flow integration of monetr prior to version 1.12.5. The vulnerability is located in the onboarding and refresh logic, where the application fails to validate user-supplied API URLs before making outbound HTTP GET requests. An authenticated attacker can provide a malicious URL, causing the server to perform requests to internal services or arbitrary external endpoints. Furthermore, the application reflects the response body of non-200 status codes back to the user in API error messages, facilitating data exfiltration or internal service discovery. The fix introduces a configuration-based allowlist for API URLs, defaulting to the official Lunch Flow endpoint.

Affected products

monetr monetr < 1.12.5

Identifiers

CVE-2026-41644
GHSA-29v9-frvh-c426
GO-2026-4966

Timeline

2026-04-17: patched: Fix committed to repository
2026-04-18: advisory: Release v1.12.5 published
2026-05-07: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.