Vulnerability Description
bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/dataelement/bisheng
- https://github.com/dataelement/bisheng/blob/3f27641987c7363d2d7b7b1a8c3c3dbe09c6
- https://github.com/dataelement/bisheng/issues/2190
- https://www.vulncheck.com/advisories/bisheng-unauthenticated-server-side-request
- https://github.com/dataelement/bisheng/issues/2190
FAQ
What is CVE-2026-82285?
CVE-2026-82285 is a vulnerability with a CVSS score of 8.2 (HIGH). bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions o...
How severe is CVE-2026-82285?
CVE-2026-82285 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82285?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.