CVE-2026-111313

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.

CVSS 4.0

7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)

CWE

CWE-918

Published

2026-10-15

Modified

2026-10-21

Record from

the NVD, synced 2026-10-21

References

• https://github.com/DaKheera47/job-ops
• https://github.com/DaKheera47/job-ops/blob/v0.13.1/orchestrator/src/server/api/routes/manual-jobs.ts#L124-L150
• https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf
• https://www.vulncheck.com/advisories/jobops-through-0.13.1-ssrf-via-post-api-manual-jobs-fetch
• https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf

Check your stackJSON