CVE-2026-72566: automatisch - Server-Side Request Forgery via HTTP Request Custom Action

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-24
Weakness: CWE-918

Description

A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authenticated user with 'manage Flow' permission to make the server fetch arbitrary URLs and retrieve the full response body via the HTTP Request app's Custom Request action.

References

https://github.com/automatisch/automatisch
https://github.com/automatisch/automatisch/blob/main/packages/backend/src/apps/http-request/actions/custom-request/index.js

Get alerted when CVE-2026-72566 or the next vulnerability affects your stack