CVE-2026-72560

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An authenticated user can use this to reach internal services, cloud metadata endpoints, and other resources not intended for external access.

• CWE-918

• https://github.com/HumanSignal/label-studio

Published

Aug 11, 2026

Last Modified

Sep 3, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72555A broken access control vulnerability in Peppermint Lab Pepp…8.1
• CVE-2026-72556A remote code execution vulnerability in ZoneMinder 1.39.17 …8.8
• CVE-2026-72557An unrestricted file upload vulnerability in Cockpit CMS 2.6…8.8
• CVE-2026-72558An SQL injection vulnerability in CiviCRM through 6.18.alpha…8.8
• CVE-2026-72559A stored cross-site scripting vulnerability in HortusFox 5.9…5.4
• CVE-2026-7256** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerab…8.8
• CVE-2026-72561A broken access control vulnerability in Peppermint Lab Pepp…8.8
• CVE-2026-72562An SQL injection vulnerability in Pimcore admin-ui-classic-b…8.8
• CVE-2026-72563A broken access control vulnerability in BadChoice Handesk a…8.1
• CVE-2026-72564An improper authorization vulnerability in fosrl/pangolin th…9.6
• CVE-2026-72565A SQL injection vulnerability in Tencent APIJSON through 8.1…9.8
• CVE-2026-72566A server-side request forgery (SSRF) vulnerability in automa…7.7