SSRF Protection Bypass via HTTP Redirect Chains

Karakeep is a elf-hostable bookmark-everything app. A Server-Side Request Forgery (SSRF) protection bypass vulnerability was identified in versions prior to 0.32.0 affecting redirect-following processing components. Although the application implements protections intended to prevent requests toward internal/private network destinations, these protections could be bypassed through crafted HTTP redirect chains. By leveraging attacker-controlled redirects, an authenticated user could cause vulnerable application components to initiate requests toward internally reachable Docker network services accessible from the application environment. The issue affected multiple processing paths, including crawler-related functionality and video download processing flows. Version 0.32.0 contains a patch.

Casky was already ahead

This CVE exploits attack patterns that Casky's 312matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Karakeep versions prior to 0.32.0 contain a Server-Side Request Forgery (SSRF) vulnerability that undermines existing security controls through HTTP redirect manipulation. While the application implements protections to block requests to internal and private network destinations, attackers can chain multiple HTTP redirects to bypass these safeguards. An authenticated user can exploit this to make the server perform unintended requests to restricted resources, potentially exposing sensitive internal services, metadata endpoints, or private network infrastructure. With a CVSS score of 7.6, this poses a significant risk to organizations deploying self-hosted Karakeep instances, particularly in environments where internal network segmentation is critical.

Casky's 312 matching skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns in redirect chains—such as multiple sequential Location headers pointing progressively toward internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or metadata services (169.254.169.254). The platform's skill coverage would flag CWE-918 violations where user-controlled input influences server-side requests without proper validation of redirect destinations. Security teams would see alerts for authenticated users initiating requests that traverse redirect chains to reach restricted endpoints, combined with network-level indicators of outbound connections to previously-blocked internal resources—enabling detection before sensitive data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

312 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45082.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-45082

Casky has 312 skills that investigate the attack patterns behind CVE-2026-45082. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn