CVE-2026-9464
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in YunaiV yudao-cloud 2026.03. The IotDataSinkHttpConfig function in /admin-api/iot/data-sink/create of the Admin API Endpoint allows server-side request forgery (SSRF). Remote attack, exploit publicly available.
Risk Assessment
Risk of using the server to attack internal network resources, data theft, or privilege escalation.
Recommendation
Update the software to the latest version. If unavailable, temporarily disable the endpoint or apply WAF rules to block suspicious requests.
Other vulnerabilities in yudao-cloud
See all- CVE-2026-58448Medium
A broken access control vulnerability in the BPM module of yudao-cloud before version 2026.06 allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an unprotected GET endpoint lacking the @PreAuthorize annotation. Attackers can read sensitive workflow data including submitted form variables, approver identities, approval and rejection comments, and process BPMN XML without ownership or tenant party verification.
- CVE-2025-10277Medium
A vulnerability was detected in YunaiV yudao-cloud up to 2025.09. This issue affects some unknown processing of the file /crm/receivable/submit. The manipulation of the argument ID results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/data-sink/create of the component Admin API Endpoint. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS