PT-2026-41941 · Scalar · Astro

CVE-2026-30118 · Published 2026-05-19 · Updated 2026-07-24

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions scalar/astro version 0.1.13

Description An issue exists involving Server-Side Request Forgery (SSRF), where a server is tricked into making requests to an unintended location. Unauthenticated attackers can force the backend server to send HTTP requests to URLs under their control via the Scalar Proxy endpoint using the scalar url query parameter. This can result in the exposure of authentication headers and cookies, potentially leading to privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-30118

Affected Products

Astro

References · 4

• 🔥 https://github.com/prassan10/ssrf-zero-click-ato-scalar · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30118 · Security Note
• https://t.me/cveNotify/220119 · Telegram Post
• https://twitter.com/CVEnew/status/2056994217914970580 · Twitter Post