Server-Side Request Forgery in zhutoutoutousan Worldquant Miner
CVE-2026-2711
Key Information:
- Vendor
Zhutoutoutousan
- Status
- Vendor
- CVE Published:
- 19 February 2026
Badges
What is CVE-2026-2711?
A vulnerability identified in zhutoutoutousan's Worldquant Miner up to version 1.0.9 resides in an obscure function of the 'ssrf_proxy.py' file. This flaw enables attackers to execute a server-side request forgery (SSRF) attack by manipulating the 'make_request' argument. The remote nature of this vulnerability allows potential exploiters to target the application from offsite locations. Despite prior notification to the project maintainers via an issue report, an update or patch has yet to be issued. Public disclosure of the exploit heightens the urgency for affected users to address this security concern promptly.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
worldquant-miner 1.0.0
worldquant-miner 1.0.1
worldquant-miner 1.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved