CVE-2026-123201mediumCWE-918

CVE-2026-123201: medium-severity vulnerability in jarun buku

buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Published

Follow this CVE+ Monitor buku

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3
Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
jarun · buku
Related CVEs — jarun buku

In the same product, most dangerous first.

CVE-2026-121627MEDIUMbuku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URLEPSS 0.2%