Unauthenticated Server-Side Request Forgery in NiubiGEO by Albert Weasker

CVE-2026-116069

What is CVE-2026-116069?

NiubiGEO, prior to version 0.3.2, suffers from an unauthenticated server-side request forgery vulnerability. This flaw enables remote attackers to exploit the server’s capability to perform requests using crafted domain values supplied through the POST /audit-plan endpoint. By providing specific inputs such as IP literals or localhost addresses, attackers can manipulate the server into fetching internal resources. This involves accessing sensitive loopback and cloud metadata, which may lead to severe information disclosure vulnerabilities. It's crucial for users of NiubiGEO to upgrade to the latest version to mitigate these risks.

References