PT-2026-41941 · Scalar · Astro

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-30118

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions scalar/astro version 0.1.13

Description A Server-Side Request Forgery (SSRF) exists in the Scalar Proxy endpoint. Unauthenticated attackers can use the scalar url query parameter to force the backend server to send HTTP requests to URLs under their control. This can lead to the exposure of authentication cookies and headers, potentially resulting in privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-30118

Affected Products

Astro

References · 3

• 🔥 https://github.com/prassan10/ssrf-zero-click-ato-scalar · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30118 · Security Note
• https://twitter.com/CVEnew/status/2056994217914970580 · Twitter Post