# CVE-2026-82638: Jina-AI Reader server-side request forgery via disabled private-address guard

Source: https://junglewise.ai/threats/cve-2026-82638-jina-ai-reader-server-side-request-forgery-via-disabled-private  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82638 · Severity: high · CVSS 7.5 · Published 2026-08-30

Jina Reader is a service that converts web pages into LLM-friendly text by fetching and processing URLs. The vulnerability disables its protection against accessing private internal networks when the service is deployed outside Google Cloud, allowing attackers to craft URLs that resolve to internal IP addresses and retrieve sensitive cloud metadata and internal service data without authentication.

## Quick answers

**Is CVE-2026-82638 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82638 being exploited in the wild.

**How severe is CVE-2026-82638?** High severity, with a CVSS score of 7.5, published 30 August 2026.

**Which products and versions are affected?** Jina AI Reader Affected versions prior to patch.

**Is there a fix for CVE-2026-82638?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82638 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82638?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) flaw in the URL validation logic of jina-ai/reader. The root cause lies in a conditional check that only enforces private-address filtering when both production mode is enabled AND a Google Cloud project is configured. Attackers outside Google Cloud deployments can bypass the private-address guard by supplying publicly resolvable DNS hostnames that map to private IP ranges (RFC 1918), allowing them to reach internal cloud metadata services, internal APIs, and other non-public resources. The vulnerable code path is in src/services/misc.ts where the `privateIpNotAcceptable` flag gates both direct IP and DNS-resolved private IP blocking. Attack requires only network-level access to the Jina Reader endpoint; no authentication is required.

## Affected products

- Jina AI Reader Affected versions prior to patch

## Timeline

- 2026-08-30: disclosed: Vulnerability disclosed via NVD as CVE-2026-82638
- 2026-08-30: other: Public advisory and GitHub repository reference available

## References

- [https://github.com/jina-ai/reader](https://github.com/jina-ai/reader)
- [https://github.com/jina-ai/reader/blob/1574bfd380d249c86c82db4dace0d9c8fe17e2b1/src/services/misc.ts](https://github.com/jina-ai/reader/blob/1574bfd380d249c86c82db4dace0d9c8fe17e2b1/src/services/misc.ts)