Server-Side Request Forgery Vulnerability in fit2cloud MeterSphere
CVE-2026-109189

5.3MEDIUM

Key Information:

Vendor

Fit2cloud

Status
Metersphere
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109189?

A vulnerability has been identified in fit2cloud MeterSphere up to version 3.6.9-lts, particularly in the Swagger3ParserApiDefinition class. This issue allows an attacker to exploit the testUrlTimeout function by manipulating the swaggerUrl argument, resulting in a server-side request forgery. This vulnerability could allow malicious actors to send unauthorized requests from the server, potentially leading to further exploitation of internal systems. The exploit for this vulnerability is now public, highlighting the urgency for affected users to apply the necessary mitigations.

Affected Version(s)

MeterSphere 3.6.9-lts

References

https://vuldb.com/vuln/416896
vdb-entrytechnical-description
https://vuldb.com/vuln/416896/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-109189
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB CNA Team
.