CVE-2026-116069 NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116069?
CVE-2026-116069 is a medium-severity vulnerability in Albert-Weasker niubigeo, published on 25 Oct 2026.
Official description
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.
Weakness: CWE-918
Which versions are affected by CVE-2026-116069?
How do I fix CVE-2026-116069?
No fix has been published for CVE-2026-116069 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116069 being exploited?
There is no known exploitation of CVE-2026-116069 in the wild and no public exploit code.
Sources
Also known as GHSA-m945-23c9-6845.