CVE-2026-121561 is a server-side request forgery (SSRF) vulnerability in HumanSignal's label-studio before version 1.23.2 and label-studio-sdk before 2.1.2. Authenticated users can exploit this flaw by importing tasks with image URLs pointing to internal services, then exporting data in formats like YOLO or COCO to read internal responses. This can also allow spoofing the Host header to capture the organization owner's API token. The vulnerability has a medium severity with a CVSS score of 6.3 and was fixed in versions 1.23.2 and 2.1.2.