CVE-2026-41644 monetr is vulnerable to server-side request forgery in Lunch Flow link creation and refresh
Authenticated users can force the monetr server to make arbitrary HTTP requests and read response bodies, potentially exposing internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41644?
CVE-2026-41644 is a high-severity server-side request forgery vulnerability in monetr, published on 7 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow integration allowed any authenticated user on a self-hosted instance to cause the monetr server to issue HTTP GET requests to arbitrary URLs supplied by the caller, with the response body from non-200 upstream responses reflected back in the API error message. This issue has been patched in version 1.12.5.
Which versions are affected by CVE-2026-41644?
3 open source packages ship an affected version, including github.com/monetr/monetr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/monetr/monetr Go | All versions | 1.12.5 |
github.com/monetr/monetr Go | All versions | 1.12.5 |
github.com/monetr/monetr Go | All versions | 1.12.5 |
Products include Monetr Monetr.
How do I fix CVE-2026-41644?
Upgrade github.com/monetr/monetr to 1.12.5 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-41644 being exploited?
There is no known exploitation of CVE-2026-41644 in the wild and no public exploit code.
Other vulnerabilities in monetr
Sources
Also known as GHSA-29v9-frvh-c426, GO-2026-4966.