CVE-2026-82638

Jina AI's reader, an open-source URL-to-text extraction service, disables its private-address guard when deployed outside Google Cloud, leaving those deployments open to unauthenticated server-side request forgery (CWE-918; CVSS 4.0 8.7 High, driven by high confidentiality impact). Because the reader fetches arbitrary URLs on behalf of unauthenticated users, an attacker can submit a hostname that resolves publicly but points to a private or link-local address, causing the reader to retrieve resources such as the cloud instance-metadata service or content of internal services reachable from the host. Successful exploitation yields high-value confidential data, since cloud metadata can expose instance credentials, though the base score indicates no integrity or availability impact. Operators who self-host jina-ai reader in environments other than Google Cloud (other cloud providers or on-premises) are affected; the vendor-hosted service, presumably running on Google Cloud where the guard remains enabled, is not described as affected. There is no known public proof of concept, the flaw is not in CISA KEV, and EPSS estimates only about a 0.3% chance of exploitation within 30 days.

What to do: Operators self-hosting jina-ai reader outside Google Cloud should upgrade to a release that restores the private-address guard (no fixed version is specified in the available data) and, as interim mitigation, restrict the reader's outbound fetches by blocking link-local and metadata addresses such as 169.254.169.254 and segmenting the host from internal services; on AWS, enforce IMDSv2 so metadata access requires a token. Review fetch logs for requests to cloud metadata endpoints or internal hostnames to check for prior abuse.