CVE-2026-54508 mauriceboe CVE debrief

Who should care

Authenticated users with list-import route access or /api/maps/resolve-url access in TREK environments should verify and restrict internal service exposure. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

TREK versions prior to 3.1.0 have an SSRF vulnerability in importGoogleList(), importNaverList(), and resolveGoogleMapsUrl() due to insecure redirect handling. This allows an authenticated trip member to reach the list-import routes and any authenticated user to reach /api/maps/resolve-url, potentially leading to blind GET requests to internal services without response-body reflection. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation.

Defensive priority

Authenticated users with list-import route access or /api/maps/resolve-url access should verify and restrict internal service exposure.

Recommended defensive actions

• Verify and restrict access to list-import routes and /api/maps/resolve-url
• Update TREK to version 3.1.0 or later
• Monitor for suspicious internal service requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-54508 record indicates TREK versions prior to 3.1.0 have an SSRF vulnerability in importGoogleList(), importNaverList(), and resolveGoogleMapsUrl(). To verify, defenders should review the official advisory and assess their environment for potential exposure. This may involve checking for affected product deployments, reviewing compensating controls, and monitoring for suspicious internal service requests. Additionally, defenders should be aware of the potential for blind GET requests to internal services without response-body reflection.

Official resources