CVE-2026-85699 — jina-ai reader server-side request forgery via redirect validation bypass
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops.…
Published: 2026-09-04 · CVSS: 8.7 · CVSS 4.0
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7