CVE-2026-72560

MediumCVSS 6.5

Published: 11/08/2026(UTC)Updated: 11/08/2026(UTC)Translated: 11/08/2026(UTC)NVD NIST

Summary

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses. An authenticated user can use this to reach internal services, cloud metadata endpoints, and other resources.

Risk Assessment

An attacker can access internal systems and data, potentially leading to confidentiality and integrity breaches.

Recommendation

Enable SSRF protection (set SSRF_PROTECTION_ENABLED to true) and update Label Studio to the latest version.

Original NVD description (English source)

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An authenticated user can use this to reach internal services, cloud metadata endpoints, and other resources not intended for external access.