CVE-2026-107394: Indico: Incomplete Server-Side Request Forgery (SSRF) check

October 8, 2026

Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico’s functionality, but of course it is never intended to let you access “special” targets such as localhost or cloud metadata endpoints. The previous fix (CVE-2026-25738) did not cover an edge case so it was still possible to craft a URL that pointed to a local target but was accepted as valid by Indico.

References

github.com/advisories/GHSA-2v95-h47v-g4x9
github.com/indico/indico/commit/44540e70ab4e20a12f14ddba5218a33749a86736
github.com/indico/indico/pull/7573
github.com/indico/indico/releases/tag/v3.3.13
github.com/indico/indico/security/advisories/GHSA-2v95-h47v-g4x9
nvd.nist.gov/vuln/detail/CVE-2026-107394

Code Behaviors & Features

Detect and mitigate CVE-2026-107394 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →