CVE Intelligence
Analysis AI-assisted

CVE-2026-54157: LobeHub SSRF via /webapi/proxy Endpoint

LobeHub versions before 2.1.57 expose the /webapi/proxy endpoint on app.lobehub.com, which fetches a URL from the POST body on the server side (CWE-918, Server-Side Request Forgery). The GitHub CNA scores the issue as critical with CVSS 3.1 base score 9.0, and the record states it is fixed in 2.1.57. The CISA KEV catalog does not list it and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

LobeHub is a platform for building and coordinating AI agent teammates. According to the GitHub Security Advisory referenced in the record, versions before 2.1.57 contain a Server-Side Request Forgery weakness (CWE-918) in the /webapi/proxy endpoint of app.lobehub.com.

Impact

The record states that the endpoint fetches a URL supplied in the POST body from the server side without authentication. The described consequences include outbound requests from LobeHub infrastructure, disclosure of Vercel deployment details, and cookie injection on the lobehub.com domain through reflected Set-Cookie headers. The GitHub CNA reports a CVSS 3.1 base score of 9.0 with critical severity.

Affected products and versions

  • Product: LobeHub, endpoint /webapi/proxy on app.lobehub.com.
  • Versions described as affected: all versions prior to 2.1.57.
  • Fixed version: 2.1.57, as stated in the description.
  • The structured affected and fixes fields in the record are empty, so the advisory should be checked directly.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted. EPSS data is not available.

Remediation and mitigation

  • Upgrade LobeHub to version 2.1.57 or later.
  • If upgrading is delayed, restrict access to the proxy endpoint at the network or gateway layer and limit outbound egress from application servers.
  • Review how the lobehub.com domain handles cookies and Set-Cookie headers.

Detection guidance

  • Review web and application logs for unusual POST requests to /webapi/proxy from unfamiliar sources.
  • Monitor outbound connections from application servers to unexpected destinations, including internal address ranges.
  • Watch for unexpected Set-Cookie headers in responses from the service.

Limitations of the available information

  • The record's CVSS vector includes PR:H (high privileges required), while the description says no authentication is needed. This conflict should be resolved against the advisory.
  • Only the GitHub advisory and the NVD and CVE.org pages were consulted, with no independent technical analysis available.
  • The record does not state whether deployment details or cookie behavior are exposed in default configurations.

Frequently asked questions

Which LobeHub versions are affected by CVE-2026-54157?

The record describes versions prior to 2.1.57 as affected. The structured affected-products field is empty, so the GitHub advisory should be checked for details.

Is CVE-2026-54157 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Exploitation status should be rechecked over time.

What is the recommended action?

Upgrade LobeHub to version 2.1.57 or later. If that is delayed, restrict access to the endpoint and limit outbound traffic from application servers.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.