CVE-2026-30118 identifies an SSRF vulnerability in scalar/astro v0.1.13 within the scalar_url query parameter of the Scalar Proxy endpoint. This vulnerability permits unauthenticated remote attackers to coerce the backend server into making arbitrary HTTP requests to attacker-specified URLs. The impact includes disclosure of sensitive authentication tokens such as cookies and headers, which may facilitate privilege escalation. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows unauthenticated attackers to induce the backend server to send HTTP requests to attacker-controlled destinations, leading to exposure of authentication cookies and headers. This can result in unauthorized access or privilege escalation within the affected application environment. The vulnerability affects confidentiality, integrity, and availability at a high level as indicated by the CVSS score of 9.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Scalar Proxy endpoint if possible and monitor for unusual outbound requests originating from the backend server. Avoid exposing the vulnerable version in untrusted environments.