CVE-2026-90769 Details
Description
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.
A server-side request forgery (SSRF) vulnerability has been identified in Open Notebook versions prior to 1.11.0. The issue arises in the POST /api/sources endpoint, where the application fails to properly validate URL parameters for 'link' type sources. This oversight allows authenticated users to manipulate URLs that the server fetches internally, potentially accessing cloud metadata, internal network services, or localhost-bound services. The vulnerability exists because the application directly incorporates user-supplied URLs into server-side requests without adequate validation, leaving internal-only or link-local addresses accessible.
Users can update to Open Notebook version 1.11.0 or later, where this vulnerability has been fixed. The latest version can be downloaded from the Open Notebook GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 13, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lfnovo/open-notebook/issues/1284 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/lfnovo/open-notebook | [email protected] | ProductVendor |
| https://github.com/lfnovo/open-notebook/blob/8889087e317177d7b6e286342ab34e0c9c01d43e/api/routers/sources.py | [email protected] | Source CodeVendor |
| https://github.com/lfnovo/open-notebook/commit/9045ea50196927eac7de647bb5b7009349236fb4 | [email protected] | Source CodeVendor |
| https://github.com/lfnovo/open-notebook/issues/1284 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/open-notebook-before-1.11.0-server-side-request-forgery-via-link-source | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lfnovo Open Notebook | >= 0, < 1.11.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 13, 2026 | New CVE Received | [email protected] |