CVE-2026-90769 — Open Notebook before 1.11.0 Server-Side Request Forgery via link-source
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services.…
Published: 2026-09-13 · CVSS: 8.3 · CVSS 4.0
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7