5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31959

CVE-2026-31959: Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval

Impact

Quill before version v0.7.1 contains a Server-Side Request Forgery (SSRF) vulnerability when attempting to fetch the Apple notarization submission logs. Exploitation requires the ability to modify API responses from Apple's notarization service, which is not possible under standard network conditions due to HTTPS with proper TLS certificate validation; however, environments with TLS-intercepting proxies (common in corporate networks), compromised certificate authorities, or other trust boundary violations are at risk.

When retrieving submission logs, Quill fetches a URL provided in the API response without validating that the scheme is https or that the host does not point to a local or multicast IP address. An attacker who can tamper with the response can supply an arbitrary URL, causing the Quill client to issue HTTP or HTTPS requests to attacker-controlled or internal network destinations. This could lead to exfiltration of sensitive data such as cloud provider credentials or internal service responses. Both the Quill CLI and library are affected when used to retrieve notarization submission logs.

Patches

Fixed in Quill version v0.7.1

Workarounds

None

Credit

Anchore would like to thank opera-aklajn (Opera) for reporting this vulnerability

Resources

Apple Get Submission Log API Documentation

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31959

CVE-2026-31959:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/anchore/quill	go	< 0.7.1	0.7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security patch for CVE-2026-31959 in anchore/quill reveals a Server-Side Request Forgery (SSRF) vulnerability. The root cause is the lack of input validation on URLs received from external sources before making HTTP requests.

The primary vulnerable function is notary.APIClient.submissionLogs. This function is responsible for fetching Apple notarization logs. The vulnerable code path took a URL from the DeveloperLogURL attribute of an Apple API response and passed it directly to http.Get. This allows an attacker, who can control the API response (e.g., via a compromised TLS-intercepting proxy), to force the Quill application to make requests to arbitrary internal or external services. This could be used to exfiltrate cloud credentials or scan internal networks.

A secondary, similar vulnerability was identified in the generate.download function, an internal tool for downloading PKI certificates. This function also used http.Get on URLs without prior validation.

The patch addresses these issues by introducing a URL validation module (internal/urlvalidate). This validator is now used before any HTTP requests are made to externally-provided URLs. It employs a multi-tiered approach:

An allowlist for known trusted domains (e.g., *.apple.com).
A denylist for dangerous targets like loopback, private, and link-local IP addresses (including cloud metadata endpoints).
A warning mechanism for any other unexpected domains.

This fix is applied in two key places: a new getUnauthenticated method in the httpClient for the notarization log fetching, and within a custom http.Client's CheckRedirect function to prevent SSRF via HTTP redirects. This ensures that both direct requests and any subsequent redirects are properly validated, effectively mitigating the SSRF risk.

Vulnerable functions

notary.APIClient.submissionLogs

quill/notary/api_client.go

The function `submissionLogs` is vulnerable to Server-Side Request Forgery (SSRF). It retrieves a developer log URL from an Apple API response and, prior to the patch, used `http.Get` to fetch this URL directly without validation. An attacker, able to intercept and modify the API response, could supply a URL pointing to an internal network resource, causing the Quill client to make an unintended request.

generate.download

quill/pki/apple/internal/generate/main.go

The `download` function within the `generate` tool was vulnerable to SSRF. It was used to download certificates from URLs scraped from Apple's website. The function used `http.Get` directly on the provided URL without validation. An attacker in a Man-in-the-Middle (MITM) position could alter the scraped URL to point to an internal service, causing the tool to make an unintended request. The fix replaces the direct `http.Get` call with a custom client that performs URL validation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.