The Vulnerability-Lookup application contains an SSRF vulnerability (CVE-2026-73432) in its remote-instance synchronization functionality. Remote instance addresses were only validated for basic URL syntax before storage, and the synchronization worker dereferenced these addresses using requests.get() with automatic redirect handling and no network boundary enforcement. An authenticated administrator with admin:access permission could configure remote instances pointing to internal, loopback, link-local, or cloud metadata HTTP(S) services. The server would then issue requests from its own network context, potentially allowing interaction with services inaccessible to the attacker directly. Redirects to internal destinations were also followed without revalidation. The patch introduces a shared outbound URL policy that restricts remote instances to HTTP(S), rejects non-public IP addresses, resolves hostnames at request time, and manually validates each redirect destination before following it, explicitly blocking private, loopback, link-local, multicast, reserved, and unspecified addresses.

A privileged attacker (authenticated administrator) could exploit this SSRF vulnerability to probe or interact with internal network services or cloud instance metadata endpoints accessible from the Vulnerability-Lookup server but not directly reachable by the attacker. The confidentiality, integrity, or availability impact depends on the nature of the internal services accessible from the server's network context. This could lead to unauthorized information disclosure or other impacts depending on the internal resources accessed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described patch introduces strict outbound URL policies that restrict remote instances to HTTP(S), reject non-public IP addresses, resolve hostnames at request time, and manually validate redirect destinations to block access to internal and reserved IP ranges. Until a patch is applied, restrict administrative access to trusted users only and avoid configuring remote instances with untrusted URLs.