CVE-2026-72552

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.

The risk includes the ability to scan internal infrastructure and steal data from cloud services, which can lead to confidentiality breaches and attack escalation. It may also enable access to sensitive internal resources.

It is recommended to immediately apply a patch or restrict access to the metatags edge endpoint, e.g., by requiring authentication and using an allowlist of URLs. Also monitor network traffic for suspicious requests.