CVE-2026-85179 — Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL
Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadat…
Published: 2026-09-03 · CVSS: 8.4 · CVSS 4.0
Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7