CVE-2026-28508: SSRF in idno/known

The SSRF vulnerability in idno/known poses a significant risk because it allows attackers to bypass authentication and CSRF protections. An attacker could leverage this to make requests to internal services that are not directly accessible from the internet, such as databases, configuration management systems, or cloud instance metadata endpoints. Successful exploitation could lead to data exfiltration, privilege escalation, and potentially complete compromise of the underlying infrastructure. The ability to retrieve cloud instance metadata, for example, could expose API keys and other sensitive credentials. This vulnerability shares similarities with other SSRF exploits where attackers leverage the server as a proxy to access restricted resources.

1. Reserved2026-02-27
2. Published2026-03-02
3. Modified2026-03-06
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-28508 is to upgrade to idno/known version 1.6.4 or later, which contains the necessary fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Restrict outbound network access from the idno/known server using a firewall or network segmentation to limit the potential blast radius. Implement strict input validation and sanitization on all user-supplied URLs to prevent attackers from manipulating the request destination. Web Application Firewalls (WAFs) configured to detect and block SSRF attempts can provide an additional layer of defense. After upgrading, confirm the fix by attempting to trigger the URL unfurl service with a crafted request to an internal resource; the request should be blocked.