CVE-2026-54166

CVE-2026-54166 is a server-side request forgery (SSRF, CWE-918) in the Shelf platform for tracking physical assets, exploitable by any authenticated user holding the asset:import permission. By supplying a crafted imageUrl to the Asset CSV Content Import feature, the user bypasses URL validation using techniques such as image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains; the server then performs an unrestricted fetch() to the attacker-chosen URL. This lets the attacker reach internal network services and cloud metadata endpoints from the application's network context, and additionally create a memory-exhaustion condition because response bodies are fully buffered before size validation. All deployments running versions prior to 1.20.3 are affected, especially those where accounts with asset:import access exist or self-registration is enabled. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported.

What to do: Upgrade Shelf to version 1.20.3 or later. Until then, restrict the asset:import permission to strictly trusted users and apply egress filtering on the Shelf server (notably blocking link-local/cloud metadata addresses such as 169.254.169.254 and internal RFC1918 ranges). Review logs for unexpected outbound HTTP requests originating from the application server, and watch available memory for signs of the buffered-response exhaustion vector.