CVE-2026-92795highCWE-918

CVE-2026-92795: high-severity vulnerability in coze-dev coze-studio

Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin

Published · Updated

Follow this CVE+ Monitor coze-studio

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
coze-dev · coze-studio
Related CVEs — coze-dev coze-studio

In the same product, most dangerous first.

CVE-2026-77934HIGHCoze Studio before 0.5.0 RCE via Unsandboxed Local Python Code RunnerEPSS 0.7%CVE-2026-92788HIGHCoze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL NodeEPSS 0.5%CVE-2026-77935HIGHCoze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API HandlersEPSS 0.4%