Executive brief
PromptHub is an AI management platform used to organize prompts and agents. A security flaw in its web interface allows registered users to bypass internal security filters and force the server to make unauthorized requests to internal network resources. This could allow an attacker to access sensitive internal data, scan private networks, or interact with other internal services that are not intended to be exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the 'POST /api/skills/fetch-remote' endpoint due to insufficient validation in the 'isPrivateIPv6' utility. The filter relies on simple string matching and incomplete prefix checks, which can be bypassed using alternate IPv6 representations. Specifically, attackers can use hex-encoded IPv4-mapped IPv6 addresses (e.g., [::ffff:7f00:1]) or non-canonical loopback strings (e.g., [0:0::1]) to reach internal IPv4 and IPv6 destinations, including loopback and RFC1918 addresses. An authenticated user can exploit this to fetch and view up to 5MB of response data from internal services. The issue is fixed in version 0.5.4.
Affected products
- legeling PromptHub 0.4.9 to 0.5.3
Timeline
- 2026-04-21: patched: Version 0.5.4 released
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD