Topic
A web vulnerability class where attackers trick servers into making unintended network requests, often reaching internal or cloud-metadata endpoints.
Defused researchers say first exploitation attempts reached their decoys on 8 October, two days after SonicWall disclosed its CVSS 10.0 SMA1000 flaw. The advisory, last updated 6 October, still says there is no evidence of exploitation.
Reality
Zenity Labs showed that one prompt to one exposed Bedrock AgentCore agent could take over every AgentCore agent in the same AWS account and region. The reach came from a broad default execution role, and narrowing it is the step teams control.
Reality
SAP rated CVE-2026-89111, an OAuth2 credential leak in its Cloud SDK for Python, CVSS 10.0 in an October 13 advisory. The Hacker News found that six later releases, 0.53.0 through 0.55.0, skip the August fix in the Destination module.
Reality
Satori, the JSX-to-SVG step behind Next.js next/og, put external input into SVG unescaped, per a dev.to explainer of CVE-2026-94545. The explainer says code execution would need the injected SVG to corrupt memory in a native parser, while SSRF needs only the injection.
Reality
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
Perspective Coverage
7 publishersReality
SonicWall patched four flaws in its SMA 1000 VPN gateways, led by CVE-2026-102255, a server-side request forgery open to remote attackers without credentials. The company reports no exploitation, though attackers used two similar SMA 1000 flaws as zero-days this year.
Perspective Coverage
4 publishersReality
SonicWall patched four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10 request-forgery bug that an attacker can use without logging in. The company says none of the four is being exploited, so owners who update now are ahead of any known attack.
Reality
Cloudflare ran frontier AI models through 45 scenarios that mutated already-blocked attacks, logging 1,107 attempts and 49 findings after human triage. The findings led to three changes in its Managed Ruleset.
Reality
Syed Anas Mohiuddin found the same SSRF flaw in MCP servers from five unrelated organisations, including Google, JPMorgan and two governments. Each server turned an address supplied through an agent into an outbound request without checking where it resolved, and any team running its own tool servers can check for the same gap.
Reality
watchTowr says attackers are already pulling cloud credentials through MLflow's Tracking Server, and VulnCheck logged scanning against a FUXA path traversal a day later.
Perspective Coverage
5 publishersReality
SonicWall confirmed both SMA1000 flaws were exploited before disclosure, and CISA gave federal agencies three days to remediate. The lower-scored console bug is the step that reaches the operating system.
Reality
Trust Boundary's walkthrough of the 2019 Capital One breach puts the weight on the IAM role attached to the firewall instance, and says the OCC consent order that followed does not mention server-side request forgery at all.
Reality
Webhooks, image proxies, link unfurlers and PDF renderers all pass a user's string to an HTTP client that sits inside your private network, where the cloud metadata endpoint answers an unauthenticated GET and hands back IAM credentials.
Reality
AWS fixed an SSRF in SSM Agent 3.3.4851.0. How much the bug actually gave an attacker depends on your IAM layout, and CloudTrail's StartSession records already show who called the vulnerable document.
Reality
The human still taps the security key, and what crosses to the agent is one origin's cookies, normalized and pushed over 127.0.0.1. The identity provider sits on the relay's blocklist, which is the part worth copying.
Reality
F5 Labs logged 69,433 probes at 169.254.169.254 in March 2025 using six ordinary parameter names. Whether any of them mattered was settled at instance launch, before any input validation ever ran.
Reality
A GitHub advisory describes an unauthenticated, full-read SSRF in the default MLflow tracking server that reaches the cloud metadata endpoint and reflects the response back to the caller.
Reality