Executive brief
Refly is an open-source agent skills builder platform. The application contains a flaw in its URL scraping feature that allows authenticated users to make the backend server fetch any URL they specify—including internal cloud metadata services and private network addresses. An attacker could abuse this to read sensitive information about internal resources or services that should not be externally accessible.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint accepts caller-supplied URLs and fetches them without validating the scheme, host, or resolved IP address, allowing requests to loopback (127.0.0.1), private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local addresses including cloud metadata services (169.254.169.254). The attack requires authentication and network access to the Refly API endpoint. An attacker can exploit this to read page titles and descriptions of internal resources, potentially exposing configuration, credentials, or metadata. Patch availability is not yet confirmed in the advisory.
Affected products
- Refly Refly through 1.1.0
Timeline
- 2026-09-14: disclosed