Server-Side Request Forgery in DataGear Affects Unauthenticated Users
CVE-2026-92566

8.8HIGH

Key Information:

Vendor: Datageartech
Status: Datagear
Vendor: CVE Published:; 16 September 2026

🔔 Create Datageartech Vulnerability Alert

What is CVE-2026-92566?

DataGear versions up to 6.0.0 contain a server-side request forgery flaw in the /dataSet/preview/Http endpoint. This vulnerability enables unauthenticated attackers to send arbitrary HTTP requests by using a controlled URI. The SSRF attack allows malicious users to perform various HTTP methods, including GET, POST, PUT, PATCH, or DELETE, to internal services and cloud metadata endpoints, capturing the complete response without any authentication or validation. This can lead to unauthorized access and potential data leaks from internal systems.