Server-side request forgery in NiubiGEO via /audit-plan domain field
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery flaw (CWE-918) in the domain field of POST /audit-plan. A remote attacker can make the server fetch internal addresses such as loopback, private, link-local or cloud metadata hosts. The responses are returned in the plan's siteEvidence JSON.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, internal-network, or cloud metadata responses returned in the plan's siteEvidence JSON.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Albert-Weasker | niubigeo | before 0.3.2 | 0.3.2 | Patch available | CNA |
- niubigeo VendorAlbert-Weasker Affected before 0.3.2 Fixed in 0.3.2 Patch available CNA
Remediation
Upgrade Albert-Weasker niubigeo to version 0.3.2, which fixes the issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA niubigeo (Albert-Weasker) Fixed in 0.3.2
Timeline
- 2026-10-25 Threatist record created from CVE-2026-116069
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-m945-23c9-6845
- 2026-11-04 CISA SSVC decision points changed
References
Other 5
- GitHub Issue #242
- https://github.com/Albert-Weasker/niubigeo
- https://github.com/Albert-Weasker/niubigeo/blob/25d1f06e87c73d1df98bb82a2cfebacc0c215111/src/server.ts#L875-L894
- https://github.com/Albert-Weasker/niubigeo/blob/25d1f06e87c73d1df98bb82a2cfebacc0c215111/src/keywords/site-evidence.ts#L127-L149
- v0.3.2 Release Notes
Sources
- CVE-2026-116069 · CVE Program
- CVE-2026-116069 · NVD
- FIRST EPSS
- GHSA-m945-23c9-6845 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences