CVE-2026-116069: Site Evidence Ts Cwe 918 Cve 2026 116069
Server-side fetch() with redirect: "follow" on a non-literal URL performs an outbound request with no destination-host restriction. When the URL is derived from request data (e.g. a user-submitted domain), an attacker can make the server fetch loopback, private-network, or link-local/cloud-metadata addresses, and redirect: "follow" additionally lets a public
TSgreprules fetch cve-2026-116069-site-evidence-ts-cwe-918-cve-2026-116069 --engine opengrepDescription
Server-side fetch() with redirect: "follow" on a non-literal URL performs an outbound request with no destination-host restriction. When the URL is derived from request data (e.g. a user-submitted domain), an attacker can make the server fetch loopback, private-network, or link-local/cloud-metadata addresses, and redirect: "follow" additionally lets a public
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.