Server-side request forgery (SSRF) vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces (localhost), or cloud metadata endpoints.
Prior to v2.4.0, eKuiper external service registrations and HTTP invocations did not validate destination IP addresses. An attacker with access to the eKuiper management API could register an external service pointing to an internal address (such as `http://127.0.0...
id: GO-ID-PENDING
modules:
- module: github.com/lf-edge/ekuiper
vulnerable_at: 1.14.7
- module: github.com/lf-edge/ekuiper/v2
versions:
- fixed: 2.4.0
vulnerable_at: 2.4.0-beta.10
summary: 'LF Edge eKuiper: SSRF in External Service in github.com/lf-edge/ekuiper'
cves:
- CVE-2025-24979
ghsas:
- GHSA-pqqc-8v73-9gg2
references:
- advisory: https://github.com/advisories/GHSA-pqqc-8v73-9gg2
- advisory: https://github.com/lf-edge/ekuiper/security/advisories/GHSA-pqqc-8v73-9gg2
- web: https://github.com/lf-edge/ekuiper/releases/tag/v2.4.0
source:
id: GHSA-pqqc-8v73-9gg2
created: 2026-09-09T18:02:11.88840447Z
review_status: UNREVIEWED
Advisory GHSA-pqqc-8v73-9gg2 references a vulnerability in the following Go modules:
Description:
Summary
Server-side request forgery (SSRF) vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services, loopback interfaces (localhost), or cloud metadata endpoints.
Details
Prior to v2.4.0, eKuiper external service registrations and HTTP invocations did not validate destination IP addresses. An attacker with access to the eKuiper management API could register an external service pointing to an internal address (such as `http://127.0.0...
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.