CVE-2026-85179

Label Studio versions through 1.23.0 fail to validate webhook URLs, creating a server-side request forgery flaw (CWE-918). An authenticated user creates a webhook whose target is an internal address — an RFC 1918 private IP or a cloud metadata endpoint (e.g., 169.254.169.254) — and the Label Studio server then dispatches requests to that destination on the attacker's behalf. With payload transmission enabled, the attacker can exfiltrate annotation data via those outbound requests, and the CVSS 4.0 score (8.4, high) reflects high confidentiality impact on the vulnerable system and high downstream impact on the internal services that get reached. Any deployment at 1.23.0 or earlier is affected; exploitation requires only a low-privileged authenticated account able to add webhooks, with no user interaction. No public proof of concept, CISA KEV listing, or in-the-wild exploitation is known, and EPSS estimates roughly a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade Label Studio to a release newer than 1.23.0, checking HumanSignal's advisories and release notes for the patched version and fixed-version guidance. Until patched, restrict the Label Studio server's outbound network access to block RFC 1918, link-local (169.254.0.0/16) and loopback destinations, and limit webhook creation to trusted administrative users. Audit existing webhooks for targets pointing at internal or cloud metadata addresses and remove or constrain any that are not needed.