CVE-2026-41130 is an SSRF vulnerability in Craft CMS affecting versions 4.0.0-RC1 up to 4.17.8 and 5.0.0-RC1 up to 5.9.14. The vulnerability arises because the `resource-js` endpoint accepts unauthenticated requests and relies on the client-supplied Host header to derive a `baseUrl` for prefix validation. If `trustedHosts` is not configured to restrict allowed hosts, an attacker can supply a malicious Host header to cause the server to issue arbitrary HTTP requests, potentially accessing internal or protected resources. The issue is fixed in versions 4.17.9 and 5.9.15.

An attacker can exploit this vulnerability to make the Craft CMS server perform arbitrary HTTP requests to internal or external systems. This can lead to information disclosure or interaction with internal services that are not directly accessible to the attacker. The CVSS 4.0 score is 5.5 (medium severity), indicating a moderate risk without requiring user interaction or privileges but with some complexity and limited impact scope.

A fix is available in Craft CMS versions 4.17.9 and 5.9.15. Users should upgrade to these or later versions to remediate the SSRF vulnerability. Additionally, administrators should explicitly configure the `trustedHosts` setting to restrict allowed Host headers, reducing the risk of exploitation. Patch status is confirmed by the version updates noted in the advisory.