CVE-2026-82638 — jina-ai reader Server-Side Request Forgery via disabled private-address guard
jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supp…
Published: 2026-08-30 · CVSS: 8.7 · CVSS 4.0
jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7