CVE-2025-24979: LF Edge eKuiper: SSRF in External Service

September 9, 2026

Server-side request forgery (SSRF) vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces (localhost), or cloud metadata endpoints.

References

github.com/advisories/GHSA-pqqc-8v73-9gg2
github.com/lf-edge/ekuiper/releases/tag/v2.4.0
github.com/lf-edge/ekuiper/security/advisories/GHSA-pqqc-8v73-9gg2
nvd.nist.gov/vuln/detail/CVE-2025-24979

Code Behaviors & Features

Detect and mitigate CVE-2025-24979 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →