CVE-2026-27170: OpenSift server-side request forgery through URL ingest

Summary

OpenSift, an AI study tool for semantic search over large datasets, has a server-side request flaw in its URL ingest feature in versions 1.1.2-alpha and below. The overly permissive fetch behavior can be coerced into requesting unsafe targets, letting an attacker probe private and local network resources from the OpenSift host process when ingesting attacker-controlled URLs.

Mitigation

Fixed in version 1.1.3-alpha. As a workaround for trusted local-only exceptions, set OPENSIFT_ALLOW_PRIVATE_URLS=true, used with caution.

Related items

• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
• MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
• HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
• InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online