Server-Side Request Forgery Vulnerability in PipesHub by PipesHub AI

CVE-2026-119712

What is CVE-2026-119712?

PipesHub prior to version 0.10.0 is susceptible to a server-side request forgery (SSRF) vulnerability found in the ImageParser._fetch_single_url function. This flaw allows adversaries to exploit the indexing service by supplying crafted image URLs within documents. Attackers can utilize various methods, including uploads, synced mailboxes, or web connectors, to trigger the fetching of internal addresses, thereby gaining access to loopback, private network, or cloud metadata endpoints. Compromised image responses may inadvertently be included in the indexed content, raising significant security concerns.

References