Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
jarun buku unaffected
Version Status Constraints
0 affected ≤ 5.1.1

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084 cve-icon cve-icon
https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105 cve-icon cve-icon
https://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675 cve-icon cve-icon
https://github.com/jarun/buku/issues/910 cve-icon cve-icon
https://github.com/jarun/buku/pull/916 cve-icon cve-icon
https://www.vulncheck.com/advisories/buku-through-5.1.1-ssrf-via-bukuserver-fetch-data-and-network-handle-api cve-icon cve-icon
History

Thu, 05 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Description Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.
Title buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-05T18:16:37.726Z

Reserved: 2026-11-05T17:58:50.301Z

Link: CVE-2026-123201

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-05T19:17:19.153

Modified: 2026-11-05T19:17:19.153

Link: CVE-2026-123201

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses