Server-Side Request Forgery Vulnerability in TaskingAI by TaskingAI
CVE-2026-111321

5.3MEDIUM

Key Information:

Vendor

Taskingai

Status
Taskingai
Vendor
CVE Published:
15 October 2026

What is CVE-2026-111321?

TaskingAI, versions up to 0.3.0, is susceptible to a server-side request forgery vulnerability. This flaw allows authenticated users, such as those with a project API key or console admin access, to exploit an unvalidated OpenAPI servers[0].url parameter in user-defined actions. By crafting an action that points to local, internal, or cloud metadata addresses, attackers can execute a POST request to /actions/{action_id}/run. This enables them to retrieve sensitive data, with the potential of reading back responses up to 64 KiB. This vulnerability poses serious risks to the integrity and confidentiality of backend systems.

Affected Version(s)

TaskingAI 0 <= 0.3.0

References

https://hackmd.io/@hieuPenguinnn/taskingai-user-action-op...
third-party-advisory
https://github.com/TaskingAI/TaskingAI/blob/v0.3.0/backen...
technical-description
https://github.com/TaskingAI/TaskingAI/blob/v0.3.0/backen...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.