What’s Vulnerable › Vulnerabilities

CVE-2026-111313: JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-21
• Weakness: CWE-918

Description

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.

Affected products

• DaKheera47 JobOps: through 0.13.1

References

• https://github.com/DaKheera47/job-ops
• https://github.com/DaKheera47/job-ops/blob/v0.13.1/orchestrator/src/server/api/routes/manual-jobs.ts#L124-L150
• https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf
• https://www.vulncheck.com/advisories/jobops-through-0.13.1-ssrf-via-post-api-manual-jobs-fetch
• https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf

Get alerted when CVE-2026-111313 or the next vulnerability affects your stack