CVE-2026-11346

A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticated attacker to probe internal network components. By crafting a specific process containing an HTTP Request component, an attacker can force the server to send arbitrary HTTP requests. By observing the varying application responses (Success, Failed, or 504 Gateway Time-out), the attacker can determine the status of internal ports, leading to internal network reconnaissance.

• CWE-918

• https://linqi.help/en/reference/security/security-advisories/#security-advisory-server-side-request-forgery-ssrf-allowing-internal-network-probing

Published

Jun 5, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-113411A vulnerability was found in Nerimity Desktop up to 2.2.2. A…6.3
• CVE-2026-11342A vulnerability has been found in code-projects Hotel and To…7.3
• CVE-2026-11344A vulnerability was found in code-projects Vehicle Managemen…7.3
• CVE-2026-113442Values entered by visitors were placed into the HTML summary…5.3
• CVE-2026-11345An Improper Authentication vulnerability in the /api/Cdn/Get…6.9
• CVE-2026-113459In versions running on TYPO3 10 and 11, the configured OpenA…7.1
• CVE-2026-113465It is possible to execute a DOM-based Cross-Site Scripting a…6.6
• CVE-2026-113466A security vulnerability has been detected in MinIO up to RE…5.3
• CVE-2026-113468The payment notification endpoint for PayPal accepts incomin…6.9
• CVE-2026-113469A failure has been identified in the SNS during dynamic data…7.5
• CVE-2026-11347The linqi application contains hardcoded cryptographic keys.…8.5
• CVE-2026-113470Mozilla blocked compromised intermediate eMudhra certificate…5.4