# CVE-2026-42281: MagicMirrorOrg MagicMirror² SSRF and secret exfiltration in /cors endpoint

Source: https://junglewise.ai/threats/cve-2026-42281-magicmirrororg-magicmirror-ssrf-and-secret-exfiltration-in-cors  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-42281 · Severity: high · CVSS 8.6 · Published 2026-05-14

MagicMirror², a popular open-source smart mirror platform, contains a security flaw in its CORS proxy component. An attacker can use this flaw to force the mirror to access private internal network services or steal sensitive configuration data like API keys and credentials. This could lead to a full compromise of the device or the cloud environment where it is hosted.

Technologies: [MagicMirrorOrg MagicMirror²](https://junglewise.ai/threats/technologies/magicmirror), [magicmirror (npm)](https://junglewise.ai/threats/technologies/npm-magicmirror). Vendors: [MagicMirrorOrg](https://junglewise.ai/threats/vendors/magicmirrororg), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-42281 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42281 being exploited in the wild.

**How severe is CVE-2026-42281?** High severity, with a CVSS score of 8.6, published 14 May 2026.

**Which products and versions are affected?** MagicMirrorOrg MagicMirror² < 2.36.0, <= 2.35.0; magicmirror (npm) SEMVER:introduced=0,fixed=2.36.0.

**Is there a fix for CVE-2026-42281?** Yes. magicmirror (npm): upgrade to 2.36.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42281 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42281?** Check whether you run MagicMirrorOrg MagicMirror² or magicmirror (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- magicmirror (npm): upgrade to 2.36.0 or later

  ```sh
  npm install magicmirror@2.36.0
  ```


## Technical details

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in the `/cors` endpoint of MagicMirror² within `js/server_functions.js`. The endpoint acts as an open proxy, fetching any user-provided URL via `fetch()` without validation or restriction of IP ranges (e.g., localhost or cloud metadata services). Furthermore, the `replaceSecretPlaceholder()` function automatically expands `**VAR_NAME**` patterns in the requested URL with server-side environment variables, allowing for the exfiltration of secrets like API keys. Attackers can exploit this to scan internal networks, access cloud instance metadata (IMDSv1), or leak credentials. The issue is fixed in version 2.36.0.

## Affected products

- MagicMirrorOrg MagicMirror² <= 2.35.0

## Identifiers

- CVE-2026-42281
- GHSA-ph6f-2cvq-79hq

## Timeline

- 2026-04-30: disclosed
- 2026-05-05: advisory
- 2026-05-05: patched: Fixed in version 2.36.0

## References

- [https://api.github.com/users/Astaruf](https://api.github.com/users/Astaruf)
- [https://github.com/Astaruf](https://github.com/Astaruf)
- [https://api.github.com/users/Astaruf/gists%7B/gist_id%7D](https://api.github.com/users/Astaruf/gists%7B/gist_id%7D)
- [https://api.github.com/users/Astaruf/repos](https://api.github.com/users/Astaruf/repos)
- [https://avatars.githubusercontent.com/u/43656486?v=4](https://avatars.githubusercontent.com/u/43656486?v=4)
- [https://api.github.com/users/Astaruf/events%7B/privacy%7D](https://api.github.com/users/Astaruf/events%7B/privacy%7D)

## Related threats

- [MagicMirror socket payload secret placeholder expansion](https://junglewise.ai/threats/cve-2026-63640-magicmirror-socket-payload-secret-placeholder-expansion)
- [MagicMirror server-side request forgery in calendar module](https://junglewise.ai/threats/cve-2026-63643-magicmirror-server-side-request-forgery-in-calendar-module)
- [MagicMirror newsfeed server-side request forgery in CHECK_ARTICLE_URL](https://junglewise.ai/threats/cve-2026-63642-magicmirror-newsfeed-server-side-request-forgery-in-check-article)
- [MagicMirror Socket.IO auth bypass allows unauthenticated module commands](https://junglewise.ai/threats/cve-2026-63641-magicmirror-socket-io-auth-bypass-allows-unauthenticated-module)