CVE-2026-92566

DataGear through version 6.0.0 contains a server-side request forgery (CWE-918) in its /dataSet/preview/Http endpoint, which is reachable without authentication. An attacker supplies a fully caller-controlled URI, causing the server to issue arbitrary GET, POST, PUT, PATCH, or DELETE requests to attacker-chosen destinations. Because the full response bodies are returned to the attacker, they can read data from internal network services and cloud instance metadata endpoints, enabling information disclosure and potentially credential theft for further attacks. Any deployment of DataGear up to and including 6.0.0 is affected, with the greatest risk to internet-exposed instances or those running in cloud environments where a metadata service is reachable. No public proof-of-concept and no confirmed in-the-wild exploitation are known, and the issue is not listed in CISA KEV.

What to do: Upgrade DataGear to a version newer than 6.0.0 as soon as a patched release is available, since no fixed version is specified in the current data. As interim mitigations, restrict or block unauthenticated access to the /dataSet/preview/Http path at a reverse proxy or WAF, and apply egress filtering so the application server cannot reach cloud metadata addresses (e.g., link-local metadata IPs) or sensitive internal services. Review access logs for unauthenticated requests to /dataSet/preview/Http that could indicate probing or exploitation.