CVE-2026-85691 Details
Description
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.
A server-side request forgery (SSRF) vulnerability has been identified in MegaParse version 0.0.55. The vulnerability exists in the POST /v1/url endpoint, which allows unauthenticated users to send requests to internal service URLs or metadata endpoints. The responses from these internal services are then returned directly to the caller in JSON format. This vulnerability could be exploited to access sensitive information from internal services or cloud metadata endpoints.
Validate URLs before fetching to ensure they do not point to internal services or metadata endpoints. Implement authentication for the API and consider using a URL allowlist.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/The-Vibe-Company/megaparse | [email protected] | ProductSource CodeVendor |
| https://github.com/The-Vibe-Company/megaparse/blob/megaparse-v0.0.55/libs/megaparse/src/megaparse/api/app.py | [email protected] | Source CodeVendor |
| https://github.com/The-Vibe-Company/megaparse/issues/259 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/megaparse-0.0.55-server-side-request-forgery-via-post-v1-url | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| The-Vibe-Company MegaParse | <= 0.0.55 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 10, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |