Vulnerability · Published May 25, 2026 · Assigned by VulDB

CVE-2026-9464YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery

Medium 4.7

In plain English

A medium-severity server-side request forgery in yudao-cloud from YunaiV. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/data-sink/create of the component Admin API Endpoint. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
YunaiV	yudao-cloud	2026.03

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-365445 | YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery vdb-entry, technical-description
VDB-365445 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #813962 | YunaiV yudao-cloud 2026.03 Server-Side Request Forgery third-party-advisory
https://github.com/fakebug111/my_public_bug/blob/main/issus05.md exploit