CVE-2026-61572
waiting for further signalsZero needs more public information before it can validate it.GHSA-cvhm-j9cp-8w59 ↗EUVD-2026-112512 ↗
description
AVideo-Encoder can fetch attacker-controlled URLs without adequately restricting internal or local destinations, allowing requests from the encoder's network position. An unauthenticated remote attacker able to reach the encoder may access internal services and, in affected flows, obtain returned data including metadata-service responses.
mitigation
Restrict the encoder's outbound network access to approved destinations and block access to private, loopback, link-local, metadata, and unnecessary service ports. Upgrade to 8.1.0 or later for the initial remediation, but treat it as incomplete and retain these network controls.
outcome
No artifact: an exploit or check was attempted but could not be produced at this moment.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-28 21:47Zghsa: trigger signal, started the run
- 2026-10-28 21:47Zpublic poc, published 2026-06-22 15:54Z
- 2026-10-28 21:47Zcve.org record for CVE-2026-61572
this entry in the feed
GET /api/v1/feed/CVE-2026-61572
{ "etk_id": "ETK-2026-2914", "cve_id": "CVE-2026-61572", "display_id": "CVE-2026-61572", "ghsa_id": "GHSA-cvhm-j9cp-8w59", "euvd_id": "EUVD-2026-112512", "status": "published", "anchor_state": "anchored", "title": "Unauthenticated server-side request forgery in AVideo-Encoder", "summary": "AVideo-Encoder can fetch attacker-controlled URLs without adequately restricting internal or local destinations, allowing requests from the encoder's network position. An unauthenticated remote attacker able to reach the encoder may access internal services and, in affected flows, obtain returned data including metadata-service responses.", "mitigation": "Restrict the encoder's outbound network access to approved destinations and block access to private, loopback, link-local, metadata, and unnecessary service ports. Upgrade to 8.1.0 or later for the initial remediation, but treat it as incomplete and retain these network controls.", "vendor": "composer", "product": "composer:WWBN/AVideo-Encoder", "affected": [ { "affected_notes": [], "affected_ranges": [ "<= 8.0" ], "ecosystem": "composer", "fixed_versions": [], "package_name": "WWBN/AVideo-Encoder", "purl": "pkg:composer/WWBN/AVideo-Encoder" } ], "cwes": [ 918 ], "cvss_score": 8.6, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 26.672367033333334, "t0_at": "2026-10-28T21:47:39.328000+00:00", "signals": { "public_poc": { "at": "2026-06-22T15:54:03+00:00", "days": -128.24555935185185, "is_lower_bound": false, "measured_at": "2026-10-28T21:47:39.328000+00:00", "url": "https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-cvhm-j9cp-8w59" }, "trigger_signal": { "at": "2026-10-28T21:47:39.328000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-28T21:47:39.328000+00:00", "url": "https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-cvhm-j9cp-8w59" } } }
published 2026-10-28 22:43Z
last change 2026-10-29 01:16Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.