HighVulnerability
CVE-2024-32965: Lobe Chat unauthorized SSRF through the X-Lobe-Chat-Auth header
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-32965
- Published
- Record updated
- Affected
- @lobehub/chat < 1.19.13
- Fixed in
- 1.19.13
- released September 20, 2024, 68 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 26.1%
Summary
Versions of lobe-chat prior to 1.19.13 contain an unauthorized SSRF vulnerability (CVE-2024-32965). An attacker can send crafted requests without logging in to reach intranet services and leak sensitive information, by modifying the JWT token header X-Lobe-Chat-Auth, which stores the proxy address and OpenAI API Key, to scan an internal network in the target lobe-web environment.
Mitigation
Fixed in 1.19.13. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Related items
- MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database
- MediumCVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosureSimilar attack · NVD/CVE Database
- HighCVE-2026-118625: MLflow Tracking Server privilege escalation via get_endpointsSimilar attack · NVD/CVE Database
- InfoWhen trust becomes the payload: Inside the threats, etc quarterly reportSimilar attack · Elastic Security Labs
- MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online