CVE-2026-111313 DaKheera47 CVE debrief

Who should care

Defenders of JobOps instances, especially those with publicly accessible API endpoints, should assess exposure and potential impact of metadata disclosure. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, assess impact, and prioritize remediation efforts.

Why it matters

CVE-2026-111313 is a server-side request forgery vulnerability in JobOps through 0.13.1 that allows disclosure of instance metadata and internal service data. Defenders should prioritize verifying exposure of JobOps instances and assess the impact of potential metadata disclosure.

• Potential disclosure of instance metadata
• Potential disclosure of internal service data
• Verification of JobOps instance exposure
• Prioritization of vulnerability remediation

Technical summary

The vulnerability exists in the POST /api/manual-jobs/fetch handler of JobOps through 0.13.1. Authenticated users or unauthenticated clients in demo mode can supply loopback, private, or cloud metadata addresses in the url field to make the server fetch internal destinations, disclosing instance metadata and internal service data. This vulnerability allows disclosure of instance metadata and internal service data. Defenders should prioritize verifying exposure of JobOps instances, especially those with publicly accessible API endpoints, and assess the impact of potential metadata disclosure.

Defensive priority

Defenders should prioritize verifying exposure of JobOps instances, especially those with publicly accessible API endpoints, and assess the impact of potential metadata disclosure.

Recommended defensive actions

• Verify exposure of JobOps instances, especially those with publicly accessible API endpoints
• Assess the impact of potential metadata disclosure
• Restrict access to the POST /api/manual-jobs/fetch handler
• Monitor for suspicious activity on JobOps instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected versions and instances remains limited. Further verification is needed to determine the full impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.