CVE-2026-72560 HumanSignal CVE debrief

Who should care

Security teams and administrators responsible for HumanSignal Label Studio installations should be aware of this vulnerability and take steps to mitigate it. Additionally, users of HumanSignal Label Studio, especially those with access to the import-from-URL endpoint, should be cautious when using this feature to avoid unintentionally exposing internal resources.

Technical summary

A server-side request forgery vulnerability exists in HumanSignal Label Studio through 1.24.0.dev0 due to SSRF_PROTECTION_ENABLED being set to false by default. An authenticated user can use the import-from-URL endpoint to fetch any caller-supplied URL, including internal loopback addresses, potentially reaching internal services, cloud metadata endpoints, and other resources not intended for external access.

Defensive priority

Medium-priority defensive tasks are required to address this server-side request forgery vulnerability.

Recommended defensive actions

• Verify the current configuration of SSRF_PROTECTION_ENABLED in HumanSignal Label Studio installations.
• Restrict access to the import-from-URL endpoint to only necessary users.
• Monitor for suspicious activity related to internal services and cloud metadata endpoints.
• Consider implementing additional security controls, such as IP blocking or URL filtering.
• Review and update the configuration of internal services to prevent unauthorized access.

Evidence notes

The CVE description and NVD entry provide evidence of a server-side request forgery vulnerability in HumanSignal Label Studio. However, details about the vendor's response or remediation efforts are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.