This vulnerability (CVE-2026-11346) involves SSRF in linqi's custom process creation feature. Authenticated users can create processes that include HTTP requests, which the server executes. By observing the server's response codes (Success, Failed, or 504 Gateway Time-out), attackers can infer the status of internal network ports and services, facilitating internal network mapping. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and low impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor, and the product is not a cloud service.

The impact is limited to internal network reconnaissance by authenticated attackers. The vulnerability does not directly allow data exfiltration or code execution but can aid attackers in mapping internal network infrastructure. There are no known exploits in the wild, and the vulnerability requires authentication, which limits exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user privileges to prevent unauthorized process creation or HTTP request crafting. Monitor for unusual internal network scanning activity initiated from the application. No official patch or temporary fix has been announced by the vendor at this time.