« Volver al listado

CVE-2026-45082

Estado: AplazadaAlta (7.6)—

Karakeep is a elf-hostable bookmark-everything app. A Server-Side Request Forgery (SSRF) protection bypass vulnerability was identified in versions prior to 0.32.0 affecting redirect-following processing components. Although the application implements protections intended to prevent requests toward internal/private network destinations, these protections could be bypassed through crafted HTTP redirect chains.

Leer descripción completaMostrar menos

By leveraging attacker-controlled redirects, an authenticated user could cause vulnerable application components to initiate requests toward internally reachable Docker network services accessible from the application environment. The issue affected multiple processing paths, including crawler-related functionality and video download processing flows. Version 0.32.0 contains a patch.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SSRF con PR:L (autenticado) en servicio remoto. Bypass de protecciones permite solicitudes a servicios internos Docker (T1090 proxy/SSRF). Acceso a datos internos (C:H) como impacto secundario.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramSSL/TLS InspectionPrivileged Account ManagementNetwork SegmentationNetwork Intrusion Prevention

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Localhostlabs — KarakeepAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45082",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45082",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T15:23:16.039726Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "karakeep-app",
          "product": "karakeep",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.32.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T15:16:38.693",
  "references": [
    {
      "url": "https://github.com/karakeep-app/karakeep/security/advisories/GHSA-g647-327m-79g9",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/karakeep-app/karakeep/security/advisories/GHSA-g647-327m-79g9",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Karakeep is a elf-hostable bookmark-everything app. A Server-Side Request Forgery (SSRF) protection bypass vulnerability was identified in versions prior to 0.32.0 affecting redirect-following processing components. Although the application implements protections intended to prevent requests toward internal/private network destinations, these protections could be bypassed through crafted HTTP redirect chains. By leveraging attacker-controlled redirects, an authenticated user could cause vulnerable application components to initiate requests toward internally reachable Docker network services accessible from the application environment. The issue affected multiple processing paths, including crawler-related functionality and video download processing flows. Version 0.32.0 contains a patch."
    },
    {
      "lang": "es",
      "value": "Karakeep es una aplicación para marcar todo alojable en elf. Se identificó una vulnerabilidad de omisión de protección de falsificación de petición del lado del servidor (SSRF) en versiones anteriores a la 0.32.0 que afecta a los componentes de procesamiento que siguen redirecciones. Aunque la aplicación implementa protecciones destinadas a prevenir peticiones hacia destinos de red internos/privados, estas protecciones podrían ser omitidas a través de cadenas de redirección HTTP manipuladas. Al aprovechar redirecciones controladas por el atacante, un usuario autenticado podría causar que los componentes vulnerables de la aplicación inicien peticiones hacia servicios de red Docker accesibles internamente desde el entorno de la aplicación. El problema afectó a múltiples rutas de procesamiento, incluyendo la funcionalidad relacionada con rastreadores y los flujos de procesamiento de descarga de video. La versión 0.32.0 contiene un parche."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "security-advisories@github.com"
}