# CVE-2026-58478: Dan-in-CA Sustainable Irrigation Platform SSRF in Node-RED plugin

Source: https://junglewise.ai/threats/cve-2026-58478-dan-in-ca-sustainable-irrigation-platform-ssrf-in-node-red-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-58478 · Severity: medium · CVSS 6.5 · Published 2026-07-14

The Sustainable Irrigation Platform (SIP), a system used for managing automated irrigation, contains a security flaw when the optional Node-RED plugin is installed. An unauthenticated attacker can force the device to send unauthorized web requests to other internal or external systems. This could allow an attacker to bypass network security controls to probe internal networks or interact with other private services that are not normally accessible from the internet.

Vendors: [Dan-in-CA](https://junglewise.ai/threats/vendors/dan-in-ca).

## Quick answers

**Is CVE-2026-58478 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58478 being exploited in the wild.

**How severe is CVE-2026-58478?** Medium severity, with a CVSS score of 6.5, published 14 July 2026.

**Which products and versions are affected?** Dan-in-CA Sustainable Irrigation Platform (SIP) through 5.2.16.

**Is there a fix for CVE-2026-58478?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58478 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58478?** Check whether you run Dan-in-CA Sustainable Irrigation Platform (SIP) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Sustainable Irrigation Platform (SIP) through version 5.2.16. The flaw is located within the optional Node-RED plugin, where the application fails to properly validate destination URLs provided in a callback parameter. By exploiting this lack of validation along with a default passphrase ('opendoor'), a remote, unauthenticated attacker can send blind HTTP requests to arbitrary internal or external hosts. This can be used to scan internal networks, bypass firewalls, or interact with internal services that the SIP device has access to. The vulnerability is tracked as CWE-918.

## Affected products

- Dan-in-CA Sustainable Irrigation Platform (SIP) through 5.2.16

## Timeline

- 2026-07-14: disclosed: Initial disclosure by Zero Science Lab and VulnCheck
- 2026-07-14: advisory: NVD publication date

## References

- [https://www.vulncheck.com/advisories/sustainable-irrigation-platform-ssrf-via-node-red-callback-url](https://www.vulncheck.com/advisories/sustainable-irrigation-platform-ssrf-via-node-red-callback-url)
- [https://www.zeroscience.mk/](https://www.zeroscience.mk/)