CVE-2026-86119: Server-Side Request Forgery (SSRF) in webstudio-is webstudio

CVE-2026-86119 is an unauthenticated SSRF vulnerability in webstudio through version 0.296.0. The vulnerability exists in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when the RESIZE_ORIGIN environment variable is not set. Exploiting this flaw, attackers can supply arbitrary URLs to these endpoints, which may lead to unauthorized reading of cloud instance metadata, access to internal services, and network reconnaissance within the instance infrastructure. The CVSS 4.0 base score is 9.2, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality and security capabilities.

Successful exploitation can lead to unauthorized disclosure of sensitive cloud instance metadata and internal network information. This can facilitate further attacks against internal services and infrastructure by revealing otherwise inaccessible resources. The vulnerability is exploitable without authentication, increasing the risk of widespread impact.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should ensure the RESIZE_ORIGIN environment variable is properly set or restrict access to the affected proxy routes to trusted users only.