This vulnerability in HumanSignal Label Studio (up to 1.24.0.dev0) involves SSRF due to the default configuration where SSRF_PROTECTION_ENABLED is false. The import-from-URL endpoint does not restrict URLs, allowing authenticated users to make requests to internal network resources, potentially exposing sensitive internal services or metadata endpoints. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and required privileges but no user interaction. No official patch or remediation level has been published yet.

An authenticated user can exploit this SSRF vulnerability to make the server perform HTTP requests to internal network resources, including loopback addresses and cloud metadata endpoints. This could lead to unauthorized information disclosure from internal services that are not intended to be accessible externally. There is no indication of integrity or availability impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the import-from-URL endpoint to trusted users only and consider network-level controls to limit server access to sensitive internal resources. Monitor vendor communications for updates on official fixes or configuration changes to enable SSRF protection.