PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111321 TaskingAI CVE debrief

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. This vulnerability can lead to potential exposure of sensitive information, disruption of service, and other security risks. Defenders should assess the exposure of their TaskingAI deployments, especially where authenticated users can create actions, and prioritize remediation.

Vendor
TaskingAI
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-15
Original CVE updated
2026-10-16
Advisory published
2026-10-15
Advisory updated
2026-10-16

Who should care

Defenders responsible for TaskingAI deployments, especially those with authenticated users who can create actions, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify and remediate the vulnerability to prevent potential security risks.

Why it matters

CVE-2026-111321 is a server-side request forgery vulnerability in TaskingAI through 0.3.0 that allows authenticated attackers to make arbitrary HTTP requests. Defenders should prioritize verifying and remediating this vulnerability in TaskingAI deployments, especially where authenticated users can create actions.

  • Authenticated attackers can make backend send arbitrary HTTP requests
  • Potential for reading sensitive information from loopback, internal or cloud metadata addresses
  • Possible disruption of service through SSRF attacks
  • Verification of TaskingAI deployments and user access controls is necessary

Technical summary

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers[0].url in a user-defined action. Attackers holding a project API key or console admin login can create an action pointing to loopback, internal or cloud metadata addresses and run it via POST /actions/{action_id}/run to read back up to 64 KiB of responses.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in TaskingAI deployments, especially where authenticated users can create actions.

Recommended defensive actions

  • Verify and remediate TaskingAI deployments to prevent SSRF attacks
  • Restrict creation of actions to authorized users
  • Monitor for suspicious activity in TaskingAI logs
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, additional information on exploitation or impact is limited. Defenders should verify the vulnerability in TaskingAI deployments, especially where authenticated users can create actions, and review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111321 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111321

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111321 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111321

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • TaskingAI through 0.3.0 SSRF via OpenAPI servers[0].url in Actions

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111321.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://hackmd.io/@hieuPenguinnn/taskingai-user-action-openapi-server-url-ssrf

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/TaskingAI/TaskingAI/blob/v0.3.0/backend/app/services/tool/action/openapi_utils.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/TaskingAI/TaskingAI/blob/v0.3.0/backend/app/services/tool/action/openapi_call.py

    Supplemental source - technical-description

  • Source reference

    Unverified legacy reference

    URL: https://github.com/TaskingAI/TaskingAI

    Supplemental source - product

  • Source reference

    Unverified legacy reference

    URL: https://www.vulncheck.com/advisories/taskingai-through-0.3.0-ssrf-via-openapi-servers-0-url-in-actions

    Supplemental source - third-party-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.