Quick answers
- Is CVE-2026-9813 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9813 being exploited in the wild.
- How severe is CVE-2026-9813?
- Informational severity, with a CVSS score of 6.2, published 28 May 2026.
- Which products and versions are affected?
- FlowIntel up to version 3.3.0.
- Is there a fix for CVE-2026-9813?
- A patch was published on 2026-05-28: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9813 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-9813?
- Check whether you run FlowIntel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in FlowIntel versions up to 3.3.0 within the external reference URL probe functionality located in `app/case/task.py`. The application fails to sufficiently validate URL schemes and resolved destination addresses when processing user-submitted external reference URLs. An authenticated attacker can exploit this by submitting a crafted URL, causing the server to issue an HTTP HEAD request to restricted network resources such as loopback (127.0.0.1), private IP ranges, or cloud metadata endpoints (e.g., 169.254.169.254). This can be used to map internal services or exfiltrate sensitive environment data. A patch has been identified in the project's version control system.
Affected products
- FlowIntel FlowIntel up to version 3.3.0
Timeline
- 2026-05-28: advisory: CVE-2026-9813 published by CIRCL/NVD
- 2026-05-28: patched: Fix committed to GitHub repository