Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111313JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

Medium 6.5

In plain English

A medium-severity server-side request forgery in JobOps from DaKheera47. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata addresses in the url field to read returned page content, disclosing instance metadata and internal service data.

Affected products (as reported)

Vendor	Product	Versions
DaKheera47	JobOps	0 – through 0.13.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://hackmd.io/@hieuPenguinnn/job-ops-manual-jobs-fetch-ssrf third-party-advisory
https://github.com/DaKheera47/job-ops/blob/v0.13.1/orchestrator/src/server/api/routes/manual-jobs.ts#L124-L150 technical-description
https://github.com/DaKheera47/job-ops product
VulnCheck Advisory: JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch third-party-advisory