CVE-2026-2532 lintsinghua DeepAudit IP Address embedding_config.py server-side request forgery

Medium 5.3 Published 16 Feb 2026 Updated 23 Feb 2026

Remote attackers can exploit a server-side request forgery vulnerability in DeepAudit's IP Address Handler to access internal resources.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-2532?

CVE-2026-2532 is a medium-severity server-side request forgery vulnerability in lintsinghua DeepAudit, published on 16 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was detected in lintsinghua DeepAudit up to 3.0.3. This issue affects some unknown processing of the file backend/app/api/v1/endpoints/embedding_config.py of the component IP Address Handler. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.0.4 and 3.1.0 is capable of addressing this issue. The patch is named da853fdd8cbe9d42053b45d83f25708ba29b8b27. It is suggested to upgrade the affected component.

Weakness: CWE-918

Which versions are affected by CVE-2026-2532?

It affects 1 product.

Products include Lintsinghua Deepaudit.

How do I fix CVE-2026-2532?

No fix has been published for CVE-2026-2532 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-2532 being exploited?

There is no known exploitation of CVE-2026-2532 in the wild and no public exploit code.

CVE-2026-25729 DeepAudit Affected by User Enumeration via Broken Access Control Low 2.1

Sources

Also known as GHSA-7r5x-3969-58xr.