# CVE-2026-41644: monetr SSRF in Lunch Flow integration

Source: https://junglewise.ai/threats/cve-2026-41644-monetr-ssrf-in-lunch-flow-integration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-07. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-41644 · Severity: high · CVSS 7.1 · Published 2026-05-07

monetr is a budgeting application used to track recurring expenses. A security vulnerability in its Lunch Flow integration allows logged-in users to force the server to make unauthorized requests to internal or external web addresses. This could allow an attacker to scan private internal networks or access sensitive information that is normally protected from the public internet.

Technologies: [github.com/monetr/monetr (Go)](https://junglewise.ai/threats/technologies/github-com-monetr-monetr). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-41644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41644 being exploited in the wild.

**How severe is CVE-2026-41644?** High severity, with a CVSS score of 7.1, published 7 May 2026.

**Which products and versions are affected?** github.com/monetr/monetr (Go) SEMVER:introduced=0,fixed=1.12.5.

**Is there a fix for CVE-2026-41644?** Yes. github.com/monetr/monetr (Go): upgrade to 1.12.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41644 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41644?** Check whether you run github.com/monetr/monetr (Go) or Monetr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/monetr/monetr (Go): upgrade to 1.12.5 or later

  ```sh
  go get github.com/monetr/monetr@v1.12.5
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Lunch Flow integration of monetr prior to version 1.12.5. The vulnerability is located in the onboarding and refresh logic, where the application fails to validate user-supplied API URLs before making outbound HTTP GET requests. An authenticated attacker can provide a malicious URL, causing the server to perform requests to internal services or arbitrary external endpoints. Furthermore, the application reflects the response body of non-200 status codes back to the user in API error messages, facilitating data exfiltration or internal service discovery. The fix introduces a configuration-based allowlist for API URLs, defaulting to the official Lunch Flow endpoint.

## Affected products

- monetr monetr < 1.12.5

## Identifiers

- CVE-2026-41644
- GHSA-29v9-frvh-c426
- GO-2026-4966

## Timeline

- 2026-04-17: patched: Fix committed to repository
- 2026-04-18: advisory: Release v1.12.5 published
- 2026-05-07: disclosed: CVE published

## References

- [https://github.com/monetr/monetr/commit/c260caa3c573a4a396ec2d264c7641a5d958385b](https://github.com/monetr/monetr/commit/c260caa3c573a4a396ec2d264c7641a5d958385b)
- [https://github.com/monetr/monetr/pull/3122](https://github.com/monetr/monetr/pull/3122)
- [https://github.com/monetr/monetr/releases/tag/v1.12.5](https://github.com/monetr/monetr/releases/tag/v1.12.5)
- [https://github.com/monetr/monetr/security/advisories/GHSA-29v9-frvh-c426](https://github.com/monetr/monetr/security/advisories/GHSA-29v9-frvh-c426)

## Related threats

- [In monetr, unauthenticated Stripe webhook reads attacker-sized request bodies before signature validation](https://junglewise.ai/threats/cve-2026-40481-in-monetr-unauthenticated-stripe-webhook-reads-attacker-sized)
- [monetr improper authorization in transaction update endpoint](https://junglewise.ai/threats/cve-2026-39901-monetr-improper-authorization-in-transaction-update-endpoint)