CVE-2026-41644 Details

A server-side request forgery (SSRF) vulnerability has been identified in the budgeting application Monetr, specifically in versions prior to 1.12.5. This vulnerability allows authenticated users on self-hosted instances to manipulate the Monetr server into sending HTTP GET requests to arbitrary URLs of the user's choosing. The issue arises during the Lunch Flow integration setup, where the server inadvertently reflects the response body from non-200 upstream responses back to the API error message. The vulnerability is exacerbated by the fact that the URL validation process does not filter out loopback addresses or cloud-provider metadata, potentially leading to unauthorized access to sensitive information.

Users can upgrade to Monetr version 1.12.5 or later, which addresses the vulnerability by introducing a configuration option to specify allowed Lunch Flow API URLs. For those who cannot upgrade immediately, it is recommended to disable public sign-up, restrict outbound HTTP egress from the Monetr pod to only trusted Lunch Flow hosts, or enforce IMDSv2 on AWS EC2 instances.