CVE-2026-39670 is a Server-Side Request Forgery (SSRF) vulnerability in the Brecht Visual Link Preview product affecting all versions through 2.3.0. SSRF vulnerabilities enable attackers to make the server perform HTTP requests to arbitrary domains or internal systems, potentially exposing internal resources or sensitive information. The vulnerability is publicly disclosed but lacks a CVSS score and vendor-provided remediation details. No evidence of active exploitation has been reported.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the affected server send crafted requests to internal or external systems, potentially leading to information disclosure or interaction with internal services not normally accessible. However, no known exploits in the wild have been reported, and the exact impact depends on the deployment environment and network architecture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting outbound HTTP requests from the Visual Link Preview service or applying network-level controls to limit the server's ability to reach untrusted destinations. Monitor vendor channels for updates and patches addressing this vulnerability.