EUVD lists SSRF in PipesHub before 0.10.0 (EUVD-2026-114117)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- pipeshub-ai
- Product
- PipesHub
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-114117, as shared on Mastodon, describes a server-side request forgery flaw in PipesHub before 0.10.0. The entry scores it 5.3/10 (CVSS v3.1) and says attackers can make the indexing service fetch internal addresses through image URLs embedded in documents.
If you use pipeshub-ai
Upgrade PipesHub to version 0.10.0 or later.
Limit outbound requests from the indexing service to internal networks.
Review documents from untrusted sources that the indexer processes.
Upgrade PipesHub to version 0.10.0 or later
Do not trust X-Forwarded-For or X-Real-IP headers unless set by a trusted proxy
Add throttling at the reverse proxy or WAF layer
What the sources say 2
· Mastodon: “PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents.” Source
· Mastodon: “PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers.” Source