CVE-2026-111313 Details
Description
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.
A server-side request forgery (SSRF) vulnerability has been identified in JobOps versions through 0.13.1. The issue resides in the POST /api/manual-jobs/fetch handler, where it allows authenticated users, or unauthenticated clients in demo mode, to manipulate the server into fetching internal resources. Attackers can exploit this by sending loopback, private, or cloud metadata addresses in the url field. The fetched content is then returned to the client, potentially disclosing sensitive instance metadata and internal service information.
To address this vulnerability, validate the resolved IP of the target host against a denylist of internal ranges before fetching, restrict the scheme to http and https, and re-check after redirects. Additionally, consider routing outbound fetches through an egress proxy on an allowlist of public job hosts.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/DaKheera47/job-ops | [email protected] | Source CodeVendor |
| https://github.com/DaKheera47/job-ops/blob/v0.13.1/orchestrator/src/server/api/routes/manual-jobs.ts#L124-L150 | [email protected] | Source CodeVendor |
| https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/jobops-through-0.13.1-ssrf-via-post-api-manual-jobs-fetch | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JobOps | <= 0.13.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |