Is CVE-2026-82638 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82638?

CVE-2026-82638 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-82638

Description

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.