CVE-2026-111313: Server-Side Request Forgery (SSRF) in DaKheera47 JobOps

CVE-2026-111313 is a server-side request forgery vulnerability affecting JobOps through version 0.13.1. The vulnerability exists in the POST /api/manual-jobs/fetch handler, which improperly allows user-supplied URLs to be fetched by the server. Authenticated users or unauthenticated clients in demo mode can exploit this to access internal network destinations, such as loopback interfaces, private IP ranges, or cloud metadata endpoints, potentially exposing sensitive internal information.

Successful exploitation can disclose sensitive internal data, including instance metadata and internal service information, which could aid further attacks or information gathering. The vulnerability requires either authentication or access to demo mode for unauthenticated exploitation. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and demo mode to trusted users only. Monitor for unusual requests to the /api/manual-jobs/fetch endpoint and consider network-level controls to prevent server-side requests to internal or cloud metadata addresses.