CVE-2026-108521 Details
Description
A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemoteUrl of the file backend/src/utils/validation.ts of the component Add Remote Node API Endpoint. Such manipulation leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor confirms: "The node API URL could be configured by an authenticated user with node-management permission and used to initiate server-side requests. [T]he report demonstrates server-side request capability but not arbitrary internal response exfiltration."
A server-side request forgery (SSRF) vulnerability has been identified in Studio-Saelix Sencho versions through 0.97.1. The issue arises in the Add Remote Node API Endpoint, specifically within the isValidRemoteUrl function in backend/src/utils/validation.ts. This vulnerability allows authenticated users with node-management permission to manipulate the API URL and initiate server-side requests to arbitrary internal hosts and ports. The Sencho backend can be made to connect to these targets, potentially accessing sensitive information or services.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/jovair1994/db23594d74428d38606e8000beb867d4 | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-108521 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/893356 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416187 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416187/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Studio-Saelix Sencho | <= 0.94.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |