{"id":"CVE-2026-123201","title":"buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API","summary":"Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-918"],"vendor":"jarun","product":"buku","affected":["buku <= 5.1.1"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T18:16:37.726Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-123201","references":[{"url":"https://github.com/jarun/buku/issues/910"},{"url":"https://github.com/jarun/buku/pull/916"},{"url":"https://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675"},{"url":"https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105"},{"url":"https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084"},{"url":"https://www.vulncheck.com/advisories/buku-through-5.1.1-ssrf-via-bukuserver-fetch-data-and-network-handle-api","label":"VulnCheck Advisory: buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T22:38:31.459Z","slug":"CVE-2026-123201","body":"## Overview\n\nBuku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.\n\n## Affected\n\n- `buku <= 5.1.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}