CVE-2026-92795
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
Risk Assessment
An authenticated user can reach internal services and cloud credentials, risking privilege escalation and infrastructure takeover. SSRF is often the first step toward deeper network penetration.
Recommendation
Upgrade Coze Studio beyond version 0.5.1. Restrict backend egress traffic and block access to cloud metadata endpoints.
Other vulnerabilities in Coze Studio
See all- CVE-2026-92788High
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.
- CVE-2025-9604Low
coze-studio up to 0.2.4 uses a hard-coded cryptographic key in backend/domain/plugin/encrypt/aes.go (AuthSecretKey/StateSecretKey/OAuthTokenSecretKey). The attack can be remote but is considered difficult and highly complex. The vendor recommended deploying a patch and plans user-defined key management via configuration.
Original NVD description (English source)
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS