CVE-2026-85699

Jina AI Reader, an open-source web-to-content extraction service that also powers the hosted r.jina.ai endpoint, is vulnerable to server-side request forgery (CWE-918) because URL validation is applied only to the initially supplied URL and is not re-checked on subsequent redirect hops. An attacker supplies a public URL they control that responds with a redirect to an internal network address, loopback, or cloud metadata endpoint; the service follows the redirect without re-validating the target and fetches it. Because the response body of the final hop is returned to the attacker, they can read responses from internal services and, on cloud-hosted deployments, retrieve instance metadata such as temporary cloud credentials. Anyone running the reader code in self-hosted deployments is directly exposed, and the flaw also affects the hosted service. No exploitation is known: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates a 0.3% probability of exploitation in the next 30 days (22nd percentile).

What to do: Upgrade to a fixed release when one is disclosed (no fixed version is specified in the available data), or apply interim mitigations by re-validating every redirect-hop target against an allowlist that blocks private, loopback, and link-local/metadata ranges (e.g., 169.254.169.254) or by disallowing redirect-following. Operators should inventory self-hosted reader deployments and verify whether the cloud instance metadata service is reachable from them; hardening IMDS (e.g., requiring IMDSv2) limits credential theft via SSRF. Users of the hosted r.jina.ai service should watch for vendor guidance and any reported credential exposure.