Read the docs
TI-2026-84367 Aliases CVE-2026-121561GHSA-m949-r65c-x2m9

Server-side request forgery in Label Studio image exports

Priority MEDIUM 61CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Label Studio before 1.23.2 and label-studio-sdk before 2.1.2 contain a server-side request forgery flaw (CWE-918) in image-bearing export formats. An authenticated user with low privileges can read internal URLs through these exports and capture the organization owner's API token by spoofing the Host value.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed label-studio (HumanSignal): 1.23.2label-studio-sdk (HumanSignal): 2.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HumanSignallabel-studiobefore 1.23.21.23.2Patch availableCNA
HumanSignallabel-studio-sdkbefore 2.1.22.1.2Patch availableCNA
  • label-studio VendorHumanSignal Affected before 1.23.2 Fixed in 1.23.2 Patch available CNA
  • label-studio-sdk VendorHumanSignal Affected before 2.1.2 Fixed in 2.1.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*——HumanSignal
  • cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:* Versions — — ·HumanSignal

Remediation

Update label-studio to version 1.23.2 and label-studio-sdk to version 2.1.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA label-studio (HumanSignal) Fixed in 1.23.2
  • Fix · CNA label-studio-sdk (HumanSignal) Fixed in 2.1.2

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121561
  2. 2026-11-03 Alias added: GHSA-m949-r65c-x2m9
  3. 2026-11-05 Priority changed: MEDIUM → LOW
  4. 2026-11-07 CISA SSVC decision points changed
  5. 2026-11-07 Priority changed: LOW → MEDIUM

References

Patch 2

Advisory 1

Other 3

  • TI-2023-23482 Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens CVSS 3.1CRITICAL 9.8
  • TI-2025-18949 Label Studio has a Path Traversal Vulnerability via image Field CVSS 4.0HIGH 8.7
  • TI-2025-18951 Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVSS 3.1HIGH 8.6
  • TI-2023-25457 Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio CVSS 3.1HIGH 7.5
  • TI-2026-58512 Label Studio through 1.23.0 SSRF via Unvalidated Webhook URL CVSS 4.0HIGH 8.4
  • TI-2026-17727 Label Studio vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CVSS 4.0HIGH 8.6
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences