CVE-2026-34981 whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3
An unauthenticated attacker can trigger Server-Side Request Forgery in whisperX by bypassing URL validation, potentially accessing internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34981?
CVE-2026-34981 is a medium-severity server-side request forgery vulnerability in pavelzbornik whisperX-FastAPI, published on 6 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
Weakness: CWE-918
Which versions are affected by CVE-2026-34981?
It affects 1 product.
Products include Pavelzbornik Whisperx Rest Api.
How do I fix CVE-2026-34981?
No fix has been published for CVE-2026-34981 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-34981 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34981 exists.
Sources
Also known as GHSA-6rc7-r867-c635.