Apache Roller SSRF via Hidden Trackback and Enclosure Features

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standard UI, but its action remains directly reachable; the enclosure path is relevant only when an author supplies an enclosure URL. No non-default server configuration is required, and the default empty Trackback allow-list permits all destinations. Requests can reach loopback and private-network addresses, while enclosure handling exposes response status, content type, and length. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes the outbound trackback action and stops dereferencing enclosure URLs.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-82375 is a Server-Side Request Forgery vulnerability in Apache Roller 6.1.5 that allows authenticated users with entry-editing privileges to redirect the server into making arbitrary outbound HTTP requests to attacker-controlled destinations. The vulnerability exploits legacy Trackback and enclosure handling mechanisms—features that remain functional despite being hidden or deprecated in the standard UI. This matters because it enables authenticated attackers to probe internal networks, interact with backend services, access metadata endpoints (like cloud instance metadata services), or launch attacks against internal systems that trust the Roller server. Any organization running Apache Roller 6.1.5 with user accounts that have entry-editing rights faces risk, particularly in multi-tenant environments where editorial access is delegated to numerous contributors.

Casky's 331 matching skills detect the attack patterns associated with this vulnerability by mapping to MITRE techniques TA0001 (Reconnaissance) and TA0006 (Resource Development). Using Claude AI's extended reasoning capabilities, the platform identifies suspicious outbound request patterns that indicate SSRF exploitation: requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), cloud metadata endpoints (169.254.169.254), localhost services, or unusual ports from the Roller application. Practitioners analyzing findings would see HTTP requests originating from the Roller process to unexpected destinations, requests to sensitive paths like /latest/meta-data/, or network connections that contradict normal application behavior. The skills also correlate suspicious Trackback or enclosure parameter values with request destinations, helping security teams distinguish legitimate editorial workflows from reconnaissance or lateral movement attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82375.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-82375

Casky has 331 skills that investigate the attack patterns behind CVE-2026-82375. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn