CVE-2026-79788 Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address
Authenticated users can bypass admin checks to configure malicious AI providers, enabling Server-Side Request Forgery and reading internal network responses.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-79788?
CVE-2026-79788 is a high-severity server-side request forgery vulnerability in dradis-ce, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169.254.169.254) and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server issues a request to the attacker-supplied URL (server-side request forgery). For non-2xx responses, the target's response body is reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, making the SSRF readable.
Weakness: CWE-918
Which versions are affected by CVE-2026-79788?
How do I fix CVE-2026-79788?
No fix has been published for CVE-2026-79788 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-79788 being exploited?
There is no known exploitation of CVE-2026-79788 in the wild and no public exploit code.
Sources
Also known as GHSA-cmm3-fp9x-p8hx.