Medium severity · published May 25, 2026
CVE-2026-9464
YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery
4.7
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in YunaiV yudao-cloud 2026.03. This affects the function IotDataSinkHttpConfig of the file /admin-api/iot/data-sink/create of the component Admin API Endpoint. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YU
yudao-cloud · YunaiV
2026.03 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9464
github.com
https://github.com/fakebug111/my_public_bug/blob/main/issus05.md
vuldb.com
https://vuldb.com/submit/813962
vuldb.com
https://vuldb.com/vuln/365445
vuldb.com
https://vuldb.com/vuln/365445/cti
More from yudao-cloud
8.8
CVE-2025-10987
YunaiV yudao-cloud HTTP Request transfer improper authorization
8.8
CVE-2025-10277
YunaiV yudao-cloud submit improper authorization
8.8
CVE-2025-10275
YunaiV yudao-cloud transfer improper authorization
7.3
CVE-2026-7710
YunaiV yudao-cloud Ruoyi-Vue-Pro JwtAuthenticationTokenFilter.java doFilterInternal improper authentication
7.3
CVE-2026-7679
YunaiV yudao-cloud OAuth2TokenServiceImpl.java getAccessToken improper authentication