CVE-2026-102879

EUVD-2026-89414
ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata endpoints.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/claraverse-space/ClaraVerse
https://github.com/claraverse-space/ClaraVerse/blob/v0.3.1/backend/internal/security/ssrf.go
https://github.com/claraverse-space/ClaraVerse/blob/v0.3.1/backend/internal/tools/download_file_tool.go
https://github.com/claraverse-space/ClaraVerse/issues/254
https://www.vulncheck.com/advisories/claraverse-through-0.3.1-ssrf-protection-bypass