Cloud-Metadata — PoC Archivehttps://poc.intelseclab.com/tags/cloud-metadata/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Typebot Unauthenticated Preview-Chat SSRF — CVE-2026-33712https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33712-typebot-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33712-typebot-ssrf/High severity — web · CVE-2026-33712. Status: PoC. Affects: Typebot (open-source chatbot builder), preview chat endpoint. Tags: ssrf, typebot, isolated-vm, sandbox-escape, cloud-metadata, node-js, unauthenticated, chatbot.webHighssrftypebotisolated-vmsandbox-escapecloud-metadatanode-jsunauthenticatedchatbotPlunk SSRF via Unvalidated AWS SNS SubscriptionConfirmation — CVE-2026-32096https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32096-plunk-sns-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-32096-plunk-sns-ssrf/Critical severity (CVSS 9.3) — cloud · CVE-2026-32096. Status: PoC. Affects: Plunk (useplunk/plunk) email/webhook API. Tags: ssrf, aws-sns, imds, cloud-metadata, plunk, cwe-918, unauthenticated.cloudCriticalssrfaws-snsimdscloud-metadataplunkcwe-918unauthenticatedpdfmake Server-Side Request Forgery via Unvalidated Document URLs (CVE-2026-26801)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26801-pdfmake-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26801-pdfmake-ssrf/High severity — web · CVE-2026-26801. Status: Weaponized. Affects: pdfmake (Node.js PDF generation library), src/URLResolver.js. Tags: ssrf, pdfmake, node-js, cloud-metadata, aws-imds, cwe-918, credential-theft, data-exfiltration.webHighssrfpdfmakenode-jscloud-metadataaws-imdscwe-918credential-theftdata-exfiltrationMagicMirror² Unauthenticated SSRF via `/cors` Endpoint (CVE-2026-42281)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42281-magicmirror-cors-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-42281-magicmirror-cors-ssrf/Critical severity (CVSS 9.2) — web · CVE-2026-42281. Status: PoC. Affects: MagicMirror². Tags: ssrf, unauthenticated, magicmirror, cloud-metadata, secrets-exfiltration, header-injection, open-proxy, python.webCriticalssrfunauthenticatedmagicmirrorcloud-metadatasecrets-exfiltrationheader-injectionopen-proxypythonKan SSRF via Attachment Download Endpoint — CVE-2026-32255https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-32255-kan-ssrf-attachment-download/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-32255-kan-ssrf-attachment-download/High severity (CVSS 8.6) — web · CVE-2026-32255 (GHSA-qrx8-9hc6-jvqg). Status: PoC. Affects: Kan (kanbn/kan) open-source project management tool. Tags: ssrf, kan, project-management, cwe-918, cloud-metadata, unauthenticated, full-read-ssrf.webHighssrfkanproject-managementcwe-918cloud-metadataunauthenticatedfull-read-ssrfApache Flink Kubernetes Operator SSRF via jarURI (CVE-2026-40564)https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/cloud/2026-07-05_cve-2026-40564-flink-k8s-operator-ssrf/High severity — cloud · CVE-2026-40564. Status: PoC. Affects: Apache flink-kubernetes-operator. Tags: ssrf, kubernetes, flink, operator, kubernetes-operator, jarURI, cloud-metadata, crd.cloudHighssrfkubernetesflinkoperatorkubernetes-operatorjarURIcloud-metadatacrd