5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46526

CVE-2026-46526: Local Deep Research: SSRF bypass in `safe_get`

Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. The current project uses validate_url to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by urlparse to prevent SSRF attacks. However, there are indeed differences in parsing between urlparse and the library that actually sends the request. For example, in safe_get, validate_url is first used to perform an SSRF check, and then requests.get is used to send the actual request. This vulnerability is fixed in 1.6.10.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46526

CVE-2026-46526:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
local-deep-research	pip	< 1.6.10	1.6.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is a parser differential attack. The application used one library, urllib.parse, to validate URLs and another, requests (which uses urllib3), to fetch them. These libraries interpret certain malformed URLs differently. Specifically, for a URL like http://internal-ip\@public-ip, urllib.parse identifies public-ip as the host, so the validation passes. However, requests interprets the backslash as a path separator and sends the request to internal-ip, resulting in a Server-Side Request Forgery (SSRF).

The primary vulnerable functions are validate_url in ssrf_validator.py and validate_service_url in notification_validator.py, where this flawed validation occurred. The functions safe_get, safe_post, and methods of SafeSession are the key runtime indicators, as they are the entry points that consume user-supplied URLs and trigger the vulnerable validation logic. An exploit would involve calling one of these safe_ functions, which would then call the underlying vulnerable validator. The fix was to replace urllib.parse.urlparse with urllib3.util.parse_url in the validators, ensuring the validation logic matches the request logic, and to proactively reject URLs containing characters like backslashes that are often used in such attacks.

Vulnerable functions

local_deep_research.security.ssrf_validator.validate_url

src/local_deep_research/security/ssrf_validator.py

This function is vulnerable because it uses `urllib.parse.urlparse` to extract the hostname for validation. This parser can be tricked by specially crafted URLs (e.g., `http://127.0.0.1\@1.1.1.1`), causing it to see a safe hostname (`1.1.1.1`) while the actual request library (`requests`) connects to an internal IP (`127.0.0.1`). The patch replaces this with `urllib3.util.parse_url`, which matches the behavior of the `requests` library.

local_deep_research.security.notification_validator.NotificationURLValidator.validate_service_url

src/local_deep_research/security/notification_validator.py

Similar to `validate_url`, this function used the vulnerable `urllib.parse.urlparse` to extract the hostname from a URL before checking if it's a private IP. This allowed for the same parser-differential SSRF bypass. The fix was to switch to `urllib3.util.parse_url` to ensure the validation and request parsing are consistent.

local_deep_research.security.safe_requests.safe_get

src/local_deep_research/security/safe_requests.py

This function is an entry point for the vulnerability. It takes a user-provided URL and passes it to the vulnerable `validate_url` function before making a request. An attacker could exploit this function to trigger the SSRF bypass. During an exploit, this function would be seen in the call stack leading to the vulnerable validation logic.

local_deep_research.security.safe_requests.safe_post

src/local_deep_research/security/safe_requests.py

Like `safe_get`, this function acts as an entry point for the SSRF vulnerability by using the flawed `validate_url` function before sending a POST request. It would appear in the runtime profile during an exploitation attempt.

local_deep_research.security.safe_requests.SafeSession.send

src/local_deep_research/security/safe_requests.py

This method within the `SafeSession` class is also vulnerable. It's a lower-level method that can be called with a `PreparedRequest`. The patch demonstrates that even when the URL is canonicalized (e.g., `\` becomes `%5C`), the second layer of the fix (using `urllib3` for parsing) is necessary to prevent the bypass, confirming this method is part of the vulnerable execution path.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.