Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-123201buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API

Medium 5.3

In plain English

A medium-severity server-side request forgery in buku from jarun. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 66.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can target loopback, private, or cloud metadata IP addresses, which pass the weak is_bad_url() check and follow redirects, to discover internal services and read their page titles, descriptions, and keywords.

Affected products (as reported)

Vendor	Product	Versions
jarun	buku	0 – through 5.1.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/jarun/buku/issues/910 issue-tracking
https://github.com/jarun/buku/pull/916 patch, issue-tracking
https://github.com/jarun/buku/commit/13f6497afc974f02f1069b760772abe8815d1675 patch
https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/bukuserver/api.py#L97-L105 technical-description
https://github.com/jarun/buku/blob/e232ac357cbba22fe69d6d6dfc0d35512a4cd313/buku.py#L4057-L4084 technical-description
VulnCheck Advisory: buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API third-party-advisory