Is CVE-2026-90769 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90769 being exploited in the wild.

How severe is CVE-2026-90769?

High severity, with a CVSS score of 7.7, published 13 September 2026.

Which products and versions are affected?

Lfnovo Open Notebook before 1.11.0.

Is there a fix for CVE-2026-90769?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90769 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-90769?

Check whether you run Lfnovo Open Notebook at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90769: Open Notebook server-side request forgery in /api/sources

CVE-2026-90769 · Severity: high · CVSS 7.7 · Published 2026-09-13

Open Notebook is an open-source note-taking application. The application fails to validate URLs supplied to the /api/sources endpoint, allowing authenticated users to make arbitrary HTTP requests through the application server. An attacker with access can exploit this to read internal network services, cloud metadata, and localhost-bound services that should not be publicly accessible.

Technologies: Lfnovo Open Notebook. Vendors: Lfnovo.

Quick answers

Is CVE-2026-90769 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90769 being exploited in the wild.
How severe is CVE-2026-90769?: High severity, with a CVSS score of 7.7, published 13 September 2026.
Which products and versions are affected?: Lfnovo Open Notebook before 1.11.0.
Is there a fix for CVE-2026-90769?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90769 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-90769?: Check whether you run Lfnovo Open Notebook at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a server-side request forgery (SSRF) in the POST /api/sources endpoint. The application fails to properly validate or sanitize the URL parameter before making HTTP requests on behalf of the server. An authenticated user can supply arbitrary URLs pointing to internal services, cloud metadata endpoints (e.g., AWS EC2 instance metadata), or localhost services. The application will then perform the request directly, returning responses that may contain sensitive configuration, credentials, or internal data. Patches are available in version 1.11.0 and later.

Affected products

lfnovo Open Notebook before 1.11.0

Timeline

2026-09-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.