CVE-2026-116069 Albert-Weasker CVE debrief

Who should care

Defenders responsible for NiubiGEO installations, particularly those exposed to the internet, should assess their exposure and prioritize verification and remediation. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-116069 is a medium-severity unauthenticated SSRF vulnerability in NiubiGEO before version 0.3.2. Defenders should prioritize verifying exposure, restricting access, and monitoring for suspicious activity. The vulnerability allows remote attackers to make the server fetch internal addresses via a crafted domain value to POST /audit-plan.

• Potential exposure of internal network information
• Possible use in further attacks on internal systems
• Requires verification of NiubiGEO installations and access controls
• May allow attackers to read loopback, internal-network, or cloud metadata responses

Technical summary

The vulnerability exists in the NiubiGEO application before version 0.3.2. An attacker can submit a crafted domain value to the POST /audit-plan endpoint to make the server fetch internal addresses. This is an unauthenticated SSRF vulnerability that can potentially expose internal network information and be used in further attacks on internal systems. Defenders should prioritize verifying exposure of NiubiGEO installations to the internet and restricting access to the /audit-plan endpoint. The vulnerability allows remote attackers to make the server fetch internal addresses via a crafted domain value to POST /audit-plan.

Defensive priority

Defenders should prioritize verifying exposure of NiubiGEO installations to the internet and restricting access to the /audit-plan endpoint.

Recommended defensive actions

• Verify NiubiGEO installations are not exposed to the internet
• Restrict access to the /audit-plan endpoint
• Monitor for suspicious activity on the NiubiGEO server
• Update to version 0.3.2 or later if available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by Vulncheck and is publicly disclosed on GitHub and Vulncheck's website. However, details about the affected versions, exploitation, and impact are limited. Defenders should verify NiubiGEO installations, review the supplied official advisory or CVE record, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.