CVE-2026-90769

Open Notebook versions before 1.11.0 contain a server-side request forgery (SSRF, CWE-918) vulnerability in the POST /api/sources API endpoint, which accepts a URL parameter without validating its destination. An authenticated user can supply an arbitrary URL — such as a cloud metadata endpoint (e.g., 169.254.169.254), an internal network address, or a localhost-bound service — and the application server will make the request on their behalf, returning a channel through which internal-only resources can be probed and read. The practical impact includes disclosure of cloud instance credentials and other secrets reachable from the server, plus visibility into internal services that should not be exposed to application users. Anyone running an unpatched self-hosted Open Notebook instance (before 1.11.0) where untrusted users hold accounts is affected. No public proof of concept is known and the flaw is not on the CISA KEV list, but the attack is straightforward to reproduce for anyone with a valid login.

What to do: Upgrade to Open Notebook 1.11.0 or later, where URL validation on POST /api/sources is enforced. Restrict who can authenticate to the instance, and apply network-level defenses: block egress from the server to cloud metadata endpoints (169.254.169.254, fd00:ec2::254) and to internal/localhost ranges, and place the instance behind a VPN or access-controlled reverse proxy. Review application logs for /api/sources requests containing internal, link-local, or loopback URLs, and rotate any cloud credentials or API keys that were resident on the host if suspicious activity is found.