CVE-2026-101048 cloudreve CVE debrief

Who should care

Cloudreve administrators and users with administrative access should assess their exposure and take steps to restrict access to administrative endpoints and verify OAuth scope configurations.

Why it matters

CVE-2026-101048 is a medium-severity vulnerability in Cloudreve that allows for blind SSRF attacks due to inadequate OAuth scope checks. Defenders should prioritize verifying exposure, restricting access to administrative endpoints, and verifying OAuth scope configurations.

• Potential for blind server-side request forgery (SSRF) attacks
• Internal service probing via arbitrary outbound requests
• Delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints
• Verification of OAuth scope configurations for administrative users

Technical summary

Cloudreve versions before 4.17.0 have a vulnerability that allows for blind server-side request forgery (SSRF) due to inadequate OAuth scope checks for administrative node test endpoints. An OAuth client with only the Admin.Read scope can submit attacker-controlled node definitions, causing the Cloudreve server to issue outbound requests to arbitrary URLs. This vulnerability can lead to internal service probing, delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints, and other security risks. Defenders should prioritize verifying exposure of Cloudreve instances to the internet and restricting access to administrative endpoints.

Defensive priority

Defenders should prioritize verifying exposure of Cloudreve instances to the internet and restricting access to administrative endpoints.

Recommended defensive actions

• Verify Cloudreve instance exposure to the internet and restrict access to administrative endpoints
• Review OAuth scope configurations for Cloudreve administrative users
• Monitor Cloudreve logs for suspicious outbound requests
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE description and source references indicate that Cloudreve's administrative node test endpoints do not require the Admin.Write OAuth scope, allowing for potential SSRF attacks. The vulnerability exists in Cloudreve versions before 4.17.0. An OAuth client with only the Admin.Read scope can submit attacker-controlled node definitions, causing the Cloudreve server to issue outbound requests to arbitrary URLs. There are no specific details on publicly available exploits or attacks, but defenders should verify exposure, restrict

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.