CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability in Dub allows unauthenticated remote attackers to exploit the metatags edge endpoint, enabling them to make arbitrary HTTP requests to internal or external hosts. This flaw can lead to unauthorized access to internal services and potential data exfiltration from cloud metadata endpoints. Organizations using Dub should prioritize remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.