CVE-2026-119712: SSRF in PipesHub Indexing Service

PipesHub before 0.10.0 is vulnerable to SSRF via image URLs in documents. Update immediately.

CVE-2026-119712 is a Server-Side Request Forgery (SSRF) vulnerability in PipesHub, a document indexing service. The flaw in ImageParser._fetch_single_url allows attackers to embed image URLs in Markdown or HTML documents to direct the indexing service toward internal addresses: loopback, private networks, cloud metadata endpoints. It impacts administrators managing PipesHub with uploads from synchronized mailboxes or web connectors.

Official CVSS from NVD is 6.4 (medium). GitHub signals dated 2026-10-31 indicate verified proof-of-concept. The flaw is consistently described across sources. Published 2026-10-30, this is not a republication of prior news.

Administrators must update PipesHub to version 0.10.0 or later without delay. Pending update, restrict access to connectors and synchronized mailboxes feeding the indexing service. Review network logs for attempts to access internal addresses. Monitor image responses in indexed documents for anomalous signals. No generic mitigation is available until the update is deployed.

At a glance

What: Server-Side Request Forgery (SSRF) in PipesHub ImageParser._fetch_single_url. Attackers embed image URLs in Markdown/HTML documents to direct the indexing service toward internal addresses (loopback, private networks, cloud metadata endpoints). Impacts uploads from synchronized mailboxes and web connectors.
Severity: CVSS 6.4 (medium) from NVD.
Affected versions: PipesHub before 0.10.0
Fix: Update to version 0.10.0 or later.
Status: Published NVD 2026-10-30. GitHub signals 2026-10-31 indicate verified proof-of-concept. Not a republication of prior news.
Action: Update immediately to 0.10.0 or later. Restrict access to connectors and synchronized mailboxes. Review logs for access attempts to internal addresses. Monitor indexed documents for cloud metadata endpoint signals.

Sources: NVD, CVE-2026-119712

← All articles