CVE-2026-109189
6.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-918
Impact
Authenticated remote attackers can trigger server-side request forgery (SSRF) to query internal network services from the application server. Exploitation requires valid user credentials and network access to the MeterSphere web interface.
Root cause
The Swagger3ParserApiDefinition.testUrlTimeout function improperly validates the user-supplied swaggerUrl parameter when parsing Swagger definitions.
Affected systems
fit2cloud MeterSphere up to 3.6.9-lts
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No fixed version is currently available as the vendor has not responded. Block egress traffic from the MeterSphere container/host to internal RFC 1918 subnets and cloud metadata endpoints (169.254.169.254), or restrict access to the Swagger3 data import functionality.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the component Swagger3 Parser. Performing a manipulation of the argument swaggerUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.