Bug 2567713 (CVE-2026-123201)

Summary:	CVE-2026-123201 buku: buku: Information disclosure via Server-Side Request Forgery in bukuserver
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in buku. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery (SSRF) due to improper URL validation in the bukuserver component. By supplying crafted web addresses to API endpoints, an attacker can coerce the server into sending requests to internal network resources, loopback addresses, or cloud metadata services to discover services and retrieve sensitive data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2568098
Bug Blocks:

Description OSIDB Bzimport 2026-11-05 22:20:07 UTC

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.