CVE-2026-9464 YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery
Remote attackers can exploit an SSRF vulnerability in the yudao-cloud Admin API to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9464?
CVE-2026-9464 is a medium-severity server-side request forgery vulnerability in YunaiV yudao-cloud, published on 25 May 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/data-sink/create of the component Admin API Endpoint. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-918
Which versions are affected by CVE-2026-9464?
How do I fix CVE-2026-9464?
No fix has been published for CVE-2026-9464 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-9464 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-9464 exists.
Sources
Also known as GHSA-mrqr-qxqw-9753.