CVE-2026-79788: Server-Side Request Forgery (SSRF) in dradis dradis-ce

In Dradis Community Edition, the ProvidersController and AgentsController fail to enforce admin authorization because they gate their admin_required before_action on a constant (Dradis::Pro) that is never defined in the Community Edition. This allows any authenticated user without admin privileges to create an AI provider pointing to an arbitrary HTTP/HTTPS address, including internal or link-local addresses such as http://169.254.169.254. The attacker can then reassign the built-in Roslin agent to use this malicious provider. When an AI interaction is triggered, the server performs a request to the attacker-controlled URL, resulting in a server-side request forgery (SSRF). Additionally, if the target URL responds with a non-2xx HTTP status, the response body is reflected verbatim to the attacker's browser through ActionCable/Turbo Stream error messages, making the SSRF readable.

An attacker with authenticated non-admin access can exploit this vulnerability to make the server perform arbitrary HTTP requests to internal or external systems, potentially accessing sensitive internal resources. The attacker can also read the response bodies of non-successful requests, increasing the information disclosure risk. This could lead to further attacks or reconnaissance within the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor for suspicious activity involving AI provider creation or agent reassignment. Avoid exposing the Dradis CE instance to untrusted networks or users.