CVE-2026-28036 is a Server-Side Request Forgery (SSRF) vulnerability affecting SkatDesign Ratatouille versions up to 1.2.6. SSRF vulnerabilities allow attackers to make the server perform unauthorized requests, potentially accessing internal resources or services. The CVSS 3.1 base score is 6.4, indicating medium severity, with attack vector network, low attack complexity, requiring low privileges and no user interaction. The impact includes partial confidentiality and integrity loss but no availability impact. No patch or vendor advisory is currently available, and the product is not a cloud service.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to make unintended network requests. This may lead to partial disclosure of sensitive information (confidentiality impact) and unauthorized modification or influence over data (integrity impact). There is no reported impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access and monitor for unusual server request behavior related to Ratatouille. Avoid exposing the vulnerable versions in untrusted environments.