Executive brief
Wyoming is a voice processing service that handles speech-to-text and text-to-speech operations. An unauthenticated attacker can exploit a flaw in the HTTP API to redirect the server's outbound connections to malicious hosts, potentially compromising backend services and enabling further attacks on the network.
Technical details
Wyoming before version 1.10.2 contains a server-side request forgery (SSRF) vulnerability in its HTTP API endpoints (/api/info, /api/speech-to-text, /api/text-to-speech). The vulnerability stems from insufficient validation of the `uri` query parameter, which accepts arbitrary `tcp://` and `unix://` URIs without proper restriction. An unauthenticated, network-reachable attacker can supply a malicious URI to override the server-configured backend and force outbound connections to attacker-controlled hosts. The fix in version 1.10.2 enforces the `--uri` or `--allow-uri-override` flag, restricts URIs to tcp:// and unix:// schemes, and rejects the parameter by default unless explicitly enabled.
Affected products
- OHF Wyoming before 1.10.2
Timeline
- 2026-09-01: disclosed: CVE-2026-8712 published
- 2026-08-27: patched: Version 1.10.2 released with fix