CVE-2026-72552 Dub CVE debrief

Who should care

Teams using Dub, security teams monitoring for SSRF vulnerabilities, administrators of internal services potentially targeted by this vulnerability, and cloud security teams should review their exposure and implement mitigations. Vulnerability management and security teams should prioritize review of affected deployments and implement compensating controls where necessary. Security teams should also monitor for suspicious activity and review logs for exposed assets.

Technical summary

CVE-2026-72552 is a server-side request forgery vulnerability in Dub that allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The vulnerability is rated HIGH with a CVSS score of 7.5 and could be used to scan internal services or exfiltrate data from cloud metadata endpoints. Affected deployments may be vulnerable to unauthorized access or data breaches if not properly mitigated.

Defensive priority

CVE-2026-72552 is rated HIGH with a CVSS score of 7.5. Consider immediate defensive review.

Recommended defensive actions

• Review and inventory Dub instances for exposure
• Restrict access to the metatags edge endpoint
• Implement denylist for caller-supplied URLs
• Monitor for suspicious HTTP requests
• Apply vendor remediation when available

Evidence notes

The CVE-2026-72552 vulnerability allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. Evidence is based on official CVE and NVD records, but the scope of affected deployments and potential impact on cloud metadata endpoints is not well-defined. Defenders should verify exposure in their environments, review compensating controls, and monitor for suspicious activity. Additional review is needed to understand the full extent of potential vulnerability and necessary mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.