CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
An attacker with Admin.Read scope can trigger server-side request forgery via admin node test endpoints, allowing internal network probing and data exfiltration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-101048?
CVE-2026-101048 is a medium-severity server-side request forgery vulnerability in cloudreve, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.
Weakness: CWE-863
Which versions are affected by CVE-2026-101048?
7 open source packages ship an affected version, including github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve and github.com/cloudreve/Cloudreve/v4.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cloudreve/Cloudreve/v3 Go | All versions | None |
github.com/cloudreve/Cloudreve/v3 Go | All versions to 3.0.0-20250225100611-da4e44b77af4 | None |
github.com/cloudreve/Cloudreve/v3 Go | All versions to 3.0.0-20250225100611-da4e44b77af4 | None |
github.com/cloudreve/Cloudreve Go | All versions | None |
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260626022735-332a9d800205 |
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260626022735-332a9d800205 |
1 more packages
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260626022735-332a9d800205 |
How do I fix CVE-2026-101048?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-101048 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-101048 exists.
Sources
Also known as GHSA-pg9h-w4pm-q3vr, GHSA-v6w6-358x-2433, GO-2026-6106.