CVE-2026-30118 is an SSRF vulnerability affecting scalar/astro v0.1.13. The vulnerability exists in the scalar_url query parameter of the Scalar Proxy endpoint, which does not properly validate or restrict URLs. This allows unauthenticated attackers to coerce the backend server into making arbitrary HTTP requests to attacker-controlled destinations. The impact includes possible leakage of authentication cookies and headers, which could facilitate privilege escalation. No CVSS score or vendor remediation information is provided.

An attacker exploiting this SSRF vulnerability can cause the backend server to send HTTP requests to arbitrary URLs controlled by the attacker. This can lead to exposure of sensitive authentication cookies and headers, increasing the risk of unauthorized access or privilege escalation within the affected system. No evidence of active exploitation is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing network-level restrictions to limit outbound HTTP requests from the backend server or apply input validation and filtering on the scalar_url parameter to mitigate SSRF risks.