Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92566DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
High 8.2
In plain English
A high-severity server-side request forgery in datagear from datageartech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Official description
DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to internal endpoints and cloud metadata services, receiving full response bodies without authentication or validation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| datageartech | datagear | 0 – through 6.0.0 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- GitHub Issue #37 issue-tracking
- https://github.com/datageartech/datagear product
- https://github.com/datageartech/datagear/blob/fedefd4269b123e1e4f3e029906ed6e6f378c989/datagear-analysis/src/main/java/org/datagear/analysis/support/HttpDataSet.java#L386-L392 technical-description
- https://github.com/datageartech/datagear/blob/fedefd4269b123e1e4f3e029906ed6e6f378c989/datagear-web/src/main/java/org/datagear/web/config/SecurityConfigSupport.java#L449-L453 technical-description
- https://github.com/datageartech/datagear/blob/fedefd4269b123e1e4f3e029906ed6e6f378c989/datagear-web/src/main/java/org/datagear/web/config/CoreConfigSupport.java#L386-L390 technical-description
- VulnCheck Advisory: DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview third-party-advisory