Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.
Summary
Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the `SSRF_PROTECTION_ENABLED` environment variable can be bypassed to access internal web servers. This is because the current SSRF validation is done by executing a single DNS lookup to verify that the IP address is not in an excluded subnet range. This protection can be bypassed by either using HTTP redirection or performing a DNS rebinding attack.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HumanSignal | label-studio | before 1.11.0 | 1.11.0 | Patch available | CNA |
| — | label-studio (PyPI) | before 1.11.0 | 1.11.0 | Patch available | GHSA-p59w-9gqw-wj8r |
- label-studio VendorHumanSignal Affected before 1.11.0 Fixed in 1.11.0 Patch available CNA
- label-studio (PyPI) Vendor— Affected before 1.11.0 Fixed in 1.11.0 Patch available GHSA-p59w-9gqw-wj8r
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:* | before 1.11.0 | Vulnerable | HumanSignal |
- cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:* Versions before 1.11.0 Vulnerable ·HumanSignal
Remediation
- Fix · CNA label-studio (HumanSignal) Fixed in 1.11.0
- Fix · GHSA-p59w-9gqw-wj8r label-studio (PyPI) Fixed in 1.11.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-47116
- 2026-10-03 Alias added: GHSA-p59w-9gqw-wj8r
References
Other 6
- https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
- https://en.wikipedia.org/wiki/DNS_rebinding
- https://github.com/HumanSignal/label-studio
- https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/core/utils/io.py#L174-L209
- https://github.com/HumanSignal/label-studio/blob/1.8.2/label_studio/data_import/uploader.py#L127-L155
- https://github.com/pypa/advisory-database/tree/main/vulns/label-studio/PYSEC-2024-127.yaml
More HumanSignal Label Studio vulnerabilities
- TI-2023-23482 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CVSS 3.1CRITICAL 9.8
- TI-2025-18951 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVSS 3.1HIGH 8.6
- TI-2023-25457 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio CVSS 3.1HIGH 7.5
- TI-2026-17727 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CVSS 4.0HIGH 8.6
- TI-2025-30248 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter. CVSS 4.0HIGH 7.6
- TI-2023-25455 Label Studio XSS Vulnerability on Avatar Upload CVSS 3.1HIGH 7.1
Sources
- CVE-2023-47116 · CVE Program
- CVE-2023-47116 · NVD
- FIRST EPSS
- GHSA-p59w-9gqw-wj8r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences