Server-side request forgery in Kameleo proxy validation
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Kameleo up to and including 5.0.1.26 is affected in its Proxy Validation component. Manipulating the host and port arguments of InternalController.TestProxy in client-engine-application/f.cs enables server-side request forgery (CWE-918). A remote attacker with low privileges can make the server send requests to destinations they choose.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
Description from the CNA
A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may be launched remotely. Upgrading to version 5.2.0 is able to address this issue. It is suggested to upgrade the affected component. The route has been removed and replaced with /general/test-proxy in 5.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Kameleo | 5.0.1.0; 5.0.1.1; 5.0.1.2; 5.0.1.3; 5.0.1.4; 5.0.1.5; 5.0.1.6; 5.0.1.7; 5.0.1.8; 5.0.1.9; 5.0.1.10; 5.0.1.11; 5.0.1.12; 5.0.1.13; 5.0.1.14; 5.0.1.15; 5.0.1.16; 5.0.1.17; 5.0.1.18; 5.0.1.19; 5.0.1.20; 5.0.1.21; 5.0.1.22; 5.0.1.23; 5.0.1.24; 5.0.1.25; 5.0.1.26 | 5.2.0 | Patch available | CNA |
- Kameleo Vendor— Affected 5.0.1.0; 5.0.1.1; 5.0.1.2; 5.0.1.3; 5.0.1.4; 5.0.1.5; 5.0.1.6; 5.0.1.7; 5.0.1.8; 5.0.1.9; 5.0.1.10; 5.0.1.11; 5.0.1.12; 5.0.1.13; 5.0.1.14; 5.0.1.15; 5.0.1.16; 5.0.1.17; 5.0.1.18; 5.0.1.19; 5.0.1.20; 5.0.1.21; 5.0.1.22; 5.0.1.23; 5.0.1.24; 5.0.1.25; 5.0.1.26 Fixed in 5.2.0 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kameleo:kameleo:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:kameleo:kameleo:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Upgrade Kameleo to version 5.2.0, which removes the affected route and replaces it with /general/test-proxy.
Written with Claude Haiku 5.5 from the sources below · 2026-10-31
- Fix · CNA Kameleo Fixed in 5.2.0
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116280
- 2026-10-27 Alias added: GHSA-rw8v-cpxr-g9gp
- 2026-10-31 CISA SSVC decision points changed
References
Sources
- CVE-2026-116280 · CVE Program
- CVE-2026-116280 · NVD
- FIRST EPSS
- GHSA-rw8v-cpxr-g9gp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences