Vulnerability · Published Mar 21, 2026 · Assigned by VulDB

CVE-2026-4528trueleaf ApiFlow URL Validation http_proxy.service.ts validateUrlSecurity server-side request forgery

High 7.3

In plain English

A high-severity server-side request forgery in ApiFlow from trueleaf. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 76.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/proxy/http_proxy.service.ts of the component URL Validation Handler. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Affected products (as reported)

Vendor	Product	Versions
trueleaf	ApiFlow	0.9.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-352316 | trueleaf ApiFlow URL Validation http_proxy.service.ts validateUrlSecurity server-side request forgery vdb-entry, technical-description
VDB-352316 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #784197 | trueleaf apiflow ≤0.9.7 Server-Side Request Forgery third-party-advisory
https://www.notion.so/Server-Side-Request-Forgery-SSRF-in-ApiFlow-329ea92a3c4180489df2fa2702078fe5 exploit