Description

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-11T17:18:04.987Z",
  "pubdate": "2026-08-11T17:18:04.987Z",
  "executiveSummary": "This vulnerability assessment addresses a Server-Side Request Forgery (SSRF) security flaw identified in Microsoft PowerShell Core. The weakness allows an unauthorized, remote attacker to interact with internal network resources and disclose sensitive information over the network by forcing the application to initiate unauthorized outbound requests.\nThe affected product is Microsoft PowerShell Core. The primary risk implication involves unauthorized information disclosure, potentially exposing internal services, metadata endpoints, or confidential data normally sequestered behind network boundaries. The attack vector leverages the inherent capability of the vulnerable component to process external Uniform Resource Identifiers (URIs) or network fetches without adequate input validation or destination restriction.\nExploitation requirements are minimal regarding authentication, as the input specifies that an unauthorized attacker can execute the attack. However, successful exploitation typically requires the ability to supply maliciously crafted input or parameters that direct PowerShell Core to issue network requests to arbitrary or unintended destinations.\nThe impact remains significant for organizations relying on PowerShell Core for automation or network-based parsing tasks, as successful exploitation bridges external threats with internal infrastructure visibility.",
  "technicalDetails": "The vulnerability is classified as a Server-Side Request Forgery (SSRF) flaw residing within Microsoft PowerShell Core. The root cause stems from insufficient validation, sanitization, and restriction of user-supplied URIs or network endpoints processed by the underlying web-request or data-fetching cmdlets and internal functions within the execution engine.\nWhen an attacker supplies a maliciously crafted payload containing targeted URIs—such as internal IP addresses, loopback interfaces (e.g., 127.0.0.1), local file paths via supported protocols, or cloud instance metadata service endpoints—the vulnerable component fails to enforce proper boundary checks. Instead of rejecting out-of-scope or unauthorized destinations, the application initiates outbound network connections or resource retrievals on behalf of the attacker.\nThe attack flow proceeds as follows: First, the unauthorized attacker identifies an entry point or cmdlet within Microsoft PowerShell Core that accepts network-bound parameters or URL inputs. Second, the attacker crafts a specialized payload directing the application to query an internal or restricted resource over supported protocols. Third, PowerShell Core processes the input and executes the outbound request, transmitting sensitive data or internal responses back to the application context. Finally, depending on how the output is handled or reflected, the attacker achieves information disclosure by observing the response data or leveraging side-channel error behaviors.\nThe vulnerable component involves the networking and URI-handling subsystems within Microsoft PowerShell Core. Authentication and privilege requirements are minimal for triggering the flaw, as the vulnerability description specifies that an unauthorized attacker can achieve information disclosure. Network exposure depends on the deployment architecture, but environments where PowerShell Core processes untrusted input or external web requests are at elevated risk.\nPost-exploitation impact is characterized by unauthorized information disclosure. By leveraging the SSRF primitive, an attacker can map internal network topologies, access unauthenticated internal web applications, extract cloud infrastructure metadata (such as IAM credentials), and bypass standard perimeter network controls enforced by firewalls."
}