CVE-2026-79788 dradis CVE debrief

Who should care

Defenders and security teams using Dradis Community Edition should assess exposure and prioritize remediation. Roles include security administrators, DevOps teams, and developers responsible for Dradis CE deployments.

Why it matters

CVE-2026-79788 is a high-severity vulnerability in Dradis Community Edition that allows authenticated users to perform server-side request forgery (SSRF) attacks. Defenders should prioritize remediation and assess exposure, especially in deployments with untrusted or unauthenticated access.

• Potential SSRF attacks on internal or link-local hosts
• Risk of sensitive information disclosure via reflected responses
• Need for validation and sanitization of AI provider URLs
• Importance of monitoring AI interactions for suspicious activity

Technical summary

The Dradis Community Edition has a vulnerability in the ProvidersController and AgentsController, where the authorization check is never applied due to the constant `defined?(Dradis::Pro)` being undefined in CE. This allows any authenticated user to create an AI provider pointing to an arbitrary HTTP/HTTPS address and reassign the built-in Roslin agent to use it, leading to server-side request forgery (SSRF).

Defensive priority

High

Recommended defensive actions

• Review and restrict AI provider creation to admin users
• Validate and sanitize AI provider URLs
• Monitor for suspicious AI interactions and requests
• Implement compensating controls for SSRF
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dradis Community Edition. The vulnerability allows any authenticated user to create an AI provider pointing to an arbitrary HTTP/HTTPS address, leading to server-side request forgery (SSRF).

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.