Is CVE-2026-119709 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119709?

CVE-2026-119709 has a CVSS v3 severity of MEDIUM (5.8).

Back

CVE-2026-119709

Description

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.