CVE-2026-82285: BISHENG Unauthenticated Server-Side Request Forgery via Workflow Report Callback

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-08-31
Weakness: CWE-918

Description

bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names.

Affected products

dataelement bisheng: through 2.6.0-fix2

References

https://github.com/dataelement/bisheng
https://github.com/dataelement/bisheng/blob/3f27641987c7363d2d7b7b1a8c3c3dbe09c60fd7/src/backend/bisheng/api/v1/workflow.py
https://github.com/dataelement/bisheng/issues/2190
https://www.vulncheck.com/advisories/bisheng-unauthenticated-server-side-request-forgery-via-workflow-report-callback
https://github.com/dataelement/bisheng/issues/2190

Get alerted when CVE-2026-82285 or the next vulnerability affects your stack