PT-2026-26946 · Trueleaf · Apiflow

Din4 · Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-4528

NVD

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

A vulnerability was determined in trueleaf ApiFlow 0.9.7. The impacted element is the function validateUrlSecurity of the file packages/server/src/service/proxy/http proxy.service.ts of the component URL Validation Handler. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-4528

Affected Products

Apiflow

References · 5

• 🔥 https://notion.so/Server-Side-Request-Forgery-SSRF-in-ApiFlow-329ea92a3c4180489df2fa2702078fe5 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4528 · Security Note
• https://vuldb.com/?ctiid.352316 · Note
• https://vuldb.com/?id.352316 · Note
• https://vuldb.com/?submit.784197 · Note