CVE-2026-92566 is a server-side request forgery vulnerability affecting DataGear through version 6.0.0. The issue exists in the /dataSet/preview/Http endpoint, where an attacker can supply a URI that the server will request on their behalf. This allows unauthenticated attackers to perform arbitrary HTTP methods to internal endpoints and cloud metadata services, bypassing authentication and validation controls. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. Confidentiality impact is high, integrity impact is low, and availability impact is none.

An attacker can exploit this SSRF vulnerability to access internal network resources and cloud metadata services without authentication, potentially exposing sensitive information. The ability to issue various HTTP methods increases the attack surface, allowing limited modification of internal resources. The confidentiality impact is high, which may lead to data disclosure. Integrity impact is low, and availability is not affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and implement network-level controls to limit server requests to trusted destinations. Validate and sanitize user-supplied URIs to prevent SSRF exploitation.