cve.bz

CVE-2026-85179

8.4 highEPSS 0.4%

High (8.4). EPSS 0.4% chance of exploitation in the next 30 days.

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

Severity

CVSS 4.0

8.4 high
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

CVSS 3.1

8.5 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
EPSS
0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON