This vulnerability in YunaiV yudao-cloud 2026.03 allows an attacker with high privileges to manipulate the IotDataSinkHttpConfig function in the Admin API Endpoint, leading to server-side request forgery. The flaw exists in the /admin-api/iot/data-sink/create component. Exploitation can be performed remotely without user interaction, but requires elevated privileges. The vendor has not provided a fix or response, and no patch links or remediation details are available. The CVSS 4.0 vector indicates low confidentiality, integrity, and availability impact, with no scope change.

Successful exploitation of this SSRF vulnerability could allow an attacker with high privileges to cause the server to make unauthorized requests to internal or external systems. The impact on confidentiality, integrity, and availability is rated as low. There is no evidence of active exploitation in the wild. The vulnerability could potentially be used to access internal resources or services not otherwise accessible, but the requirement for high privileges limits the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should restrict access to the affected API endpoint to trusted users with high privileges only. Monitoring and network-level controls to limit outbound requests from the server may help mitigate potential exploitation. Avoid exposing the vulnerable API to untrusted networks until a patch or official mitigation is provided.