Login Request a demo
High severity · published Sep 13, 2026
CVE-2026-90769
Open Notebook before 1.11.0 Server-Side Request Forgery via link-source
7.7
CVSS
0.4%
EPSS
No
On KEV
Description
Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
open-notebook · lfnovo
before 1.11.0 · source: vendor
Affected product
OP
open-notebook
lfnovo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90769
github.com
https://github.com/lfnovo/open-notebook
github.com
https://github.com/lfnovo/open-notebook/blob/8889087e317177d7b6e286342ab34e0c9c01d43e/api/routers/sources.py
github.com
https://github.com/lfnovo/open-notebook/commit/9045ea50196927eac7de647bb5b7009349236fb4
github.com
https://github.com/lfnovo/open-notebook/issues/1284
www.vulncheck.com
https://www.vulncheck.com/advisories/open-notebook-before-1.11.0-server-side-request-forgery-via-link-source
More from open-notebook
10.0
CVE-2026-33587
Remote Code Execution (RCE) via Server-Side Template Injection (SSTI)
8.1
CVE-2026-33588
Arbitrary File Write Through Path Traversal
7.8
CVE-2026-28201
SurrealDB Injection on Open Notebook
6.5
CVE-2026-33589
Arbitrary File Read via Local File Inclusion (LFI)