CVE-2026-92795

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, an SSRF flaw (CWE-918). Any authenticated user can register a plugin tool pointing at an arbitrary URL, causing the backend server to fetch it and return the response to the attacker. Because the request originates from the trusted backend network, an attacker can reach cloud metadata endpoints (e.g., instance metadata services) and internal-only services, harvesting potentially sensitive data such as credentials. Any self-hosted Coze Studio deployment at version 0.5.1 or earlier that permits untrusted users to register plugins is affected. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not listed in CISA KEV.

What to do: Upgrade Coze Studio to a release newer than 0.5.1 that validates or allowlists plugin server URLs as soon as one is available. Interim mitigations: restrict which authenticated users can register plugin tools, and block backend egress to cloud metadata endpoints (e.g., 169.254.169.254) and internal network ranges. Review existing plugin registrations and backend access logs for requests to metadata or internal services.