Is CVE-2026-9304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9304 being exploited in the wild.

How severe is CVE-2026-9304?

Medium severity, with a CVSS score of 5, published 23 May 2026.

Is there a fix for CVE-2026-9304?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9304 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9304?

Check whether you run Cal.Com. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9304: Calcom cal.diy SSRF via HTTP Redirect in Logo API

CVE-2026-9304 · Severity: medium · CVSS 5 · Published 2026-05-23

Cal.com cal.diy, an open-source scheduling platform, contains a security flaw in its Logo API. This vulnerability allows an authenticated user to trick the server into making requests to internal systems that should be private. An attacker could use this to access sensitive internal data, such as cloud metadata or internal administrative services, potentially leading to a breach of confidential information.

Technologies: Cal.Com. Vendors: Cal.com.

Quick answers

Is CVE-2026-9304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9304 being exploited in the wild.
How severe is CVE-2026-9304?: Medium severity, with a CVSS score of 5, published 23 May 2026.
Which products and versions are affected?: calcom cal.diy up to 4.9.4.
Is there a fix for CVE-2026-9304?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9304 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9304?: Check whether you run Cal.Com. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the `validateUrlForSSRF` function within `apps/web/app/api/logo/route.ts`. While the application validates the initial URL to block restricted IP ranges (like loopback or private CIDRs), it uses the Node.js `fetch()` API for the final request without disabling automatic redirect following (e.g., `redirect: "manual"`). This creates a Time-of-Check to Time-of-Use (TOCTOU) condition where an attacker can provide a public URL that passes initial validation but then issues a 301/302 redirect to a restricted internal resource, such as AWS IMDS (169.254.169.254) or local services. Successful exploitation requires authentication and the ability to modify Team or Organization parameters.

Affected products

calcom cal.diy up to 4.9.4

Timeline

2026-04-06: disclosed: Initial discovery and PoC creation by YLChen-007.
2026-05-23: advisory: CVE-2026-9304 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.