6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25738

CVE-2026-25738: Indico has Server-Side Request Forgery (SSRF) in multiple places

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Versions prior to 3.3.10 are vulnerable to server-side request forgery. Indico makes outgoing requests to user-provides URLs in various places. This is mostly intentional and part of Indico's functionality but is never intended to let users access "special" targets such as localhost or cloud metadata endpoints. Users should upgrade to version 3.3.10 to receive a patch. Those who do not have IPs that expose sensitive data without authentication (typically because they do not host Indico on AWS) are not affected. Only event organizers can access endpoints where SSRF could be used to actually see the data returned by such a request. For those who trust their event organizers, the risk is also very limited. For additional security, both before and after patching, one may also use the common proxy-related environment variables (in particular http_proxy and https_proxy) to force outgoing requests to go through a proxy that limits requests in whatever way you deem useful/necessary. These environment variables would need to be set both on the indico-uwsgi and indico-celery services.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25738

CVE-2026-25738:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
indico	pip	< 3.3.10	3.3.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) caused by a Time-of-check Time-of-use (TOCTOU) weakness, specifically a DNS rebinding attack. The application checks if a user-provided URL points to a private IP address before making a request. This check is performed by the validate_request_url function, which in turn calls is_private_url. The is_private_url function resolves the hostname to an IP address to perform the check. However, a malicious actor could have their DNS server return a safe, public IP during this initial check, and then return a private, internal IP (like 127.0.0.1) when the application makes the actual HTTP request. This bypasses the security check and allows the attacker to make the server issue requests to internal services.

The patch addresses this by monkey-patching Python's socket.getaddrinfo function. The new implementation (safe_getaddrinfo) caches the IP addresses returned from the first DNS lookup for a given host within the request context. On subsequent lookups for the same host, it checks if any new, private IP addresses have appeared. If so, it raises an InsecureRequestError, preventing the DNS rebinding attack. The functions validate_request_url and is_private_url are the core components of the vulnerable validation logic that was bypassed.

Vulnerable functions

is_private_url

indico/util/network.py

This function performs a DNS lookup to check if a hostname resolves to a private IP address. It is vulnerable to a Time-of-check Time-of-use (TOCTOU) vulnerability, specifically DNS rebinding. An attacker can make a hostname resolve to a public IP during this check, and then to a private IP when the actual request is made, bypassing the SSRF protection.

validate_request_url

indico/util/network.py

This function uses `is_private_url` to validate a URL. It is the entry point for the vulnerable SSRF check. The patch adds a caching mechanism to `g` (Flask's application context global) to store DNS lookup results and prevent DNS rebinding attacks, indicating this function was the place where the check was initiated.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.