Executive brief
Vane, an AI-powered search engine, contains a security flaw that allows unauthorized individuals to force the server to make unintended network requests. This could be used to probe internal company networks, access sensitive cloud metadata, or interact with private services that are not normally accessible from the internet. Additionally, the server may leak fragments of the data it retrieves from these internal sources back to the attacker.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Model Provider API of ItzCrazyKns Vane through version 1.12.1. The 'POST /api/providers' endpoint fails to validate the 'baseURL' parameter provided by unauthenticated users. When a new provider is registered, the server immediately performs a GET request to the attacker-specified URL (e.g., appending '/api/tags' for Ollama providers). Because the application reflects server-side fetch error messages back to the client, an attacker can achieve partially-readable SSRF, enabling them to exfiltrate data from internal services, cloud metadata endpoints (like 169.254.169.254), or perform internal port scanning. As of the advisory date, no patch has been released.
Affected products
- ItzCrazyKns Vane up to 1.12.1
Timeline
- 2026-05-24: disclosed: Vulnerability reported via GitHub issue and VulDB
- 2026-05-24: advisory