{"answers":{"affected":"3 open source packages ship an affected version, including bbot.","exploited":"There is no known exploitation of CVE-2026-12566 in the wild and no public exploit code.","fix":"Upgrade bbot to 2.8.5 or later.","what":"CVE-2026-12566 is a low-severity server-side request forgery vulnerability in Black Lantern Security BBOT, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-12566 and fix it if it is affected.\n\nWhat it is: CVE-2026-12566 is a low-severity server-side request forgery vulnerability in Black Lantern Security BBOT, published on 17 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-12566 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- bbot (PyPI): affected from 2.0.0; fixed in 2.8.5\n- bbot (PyPI): affected from 2.0.0; fixed in 2.8.5\n- bbot (PyPI): affected from 2.0.0; fixed in 2.8.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-12566/ (Markdown: https://insights.sbomify.com/CVE-2026-12566/index.md)","id":"CVE-2026-12566","markdown":"https://insights.sbomify.com/CVE-2026-12566/index.md","name":"CVE-2026-12566","record":{"aliases":["GHSA-3mp7-vp6j-2mxx","PYSEC-2026-2391"],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"BBOT security tool","requires_auth":"none","summary":"A man-in-the-middle attacker can redirect authentication requests to arbitrary endpoints via unvalidated realm headers, potentially leaking tokens.","user_interaction":"required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"BLSOPS","cpe":[],"cvss":{"score":3.1,"severity":"low","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"description":"The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"SSRF via unvalidated WWW-Authenticate realm in docker_pull module","id":"CVE-2026-12566","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":3,"n_references":1,"next":{"headline":"Symlink-following arbitrary write via github_workflows module","id":"CVE-2026-12567"},"packages":[{"ecosystem":"PyPI","fixed":["2.8.5"],"introduced":["2.0.0"],"last_affected":[],"package":"bbot","purl":null,"source":"GHSA-3mp7-vp6j-2mxx"},{"ecosystem":"PyPI","fixed":["2.8.5"],"introduced":["2.0.0"],"last_affected":[],"package":"bbot","purl":"pkg:pypi/bbot","source":"GHSA-3mp7-vp6j-2mxx"},{"ecosystem":"PyPI","fixed":["2.8.5"],"introduced":["2.0.0"],"last_affected":[],"package":"bbot","purl":"pkg:pypi/bbot","source":"PYSEC-2026-2391"}],"prev":{"headline":"Path Traversal (Zip-Slip) in unarchive module","id":"CVE-2026-12565"},"products":["BBOT"],"published":"2026-06-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-06-18","vendors":["Black Lantern Security"]},"summary":"A man-in-the-middle attacker can redirect authentication requests to arbitrary endpoints via unvalidated realm headers, potentially leaking tokens.","url":"https://insights.sbomify.com/CVE-2026-12566/"}