Description

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-30T14:17:03.610Z",
  "pubdate": "2026-08-30T14:17:03.610Z",
  "executiveSummary": "The Jina AI reader component contains a critical Server-Side Request Forgery (SSRF) vulnerability due to insufficient input validation and conditional security controls. The vulnerability arises because the service disables its private-address guard mechanism when operating outside of Google Cloud Platform (GCP) environments.\nThis flaw allows unauthenticated remote attackers to bypass network perimeter controls and force the application to make arbitrary HTTP requests to internal, non-routable, or metadata-specific endpoints. By leveraging DNS rebinding or supplying publicly resolvable hostnames that resolve to internal IP addresses, an attacker can access sensitive internal service content or cloud metadata interfaces that were intended to be unreachable from the public internet.\nThe risk is significant as it permits unauthorized data exfiltration, internal service reconnaissance, and potential exploitation of internal APIs that lack secondary authentication. Successful exploitation requires no prior authentication and relies on the server's ability to resolve and connect to user-supplied targets. Organizations deploying Jina AI reader in environments other than GCP are at the highest risk, as the primary defense mechanism against internal resource access is effectively deactivated.",
  "technicalDetails": "The vulnerability is rooted in an improperly implemented security check within the Jina AI reader's request-handling logic. The application employs a 'private-address guard' designed to block requests directed toward private IP address ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and cloud-specific metadata services such as 169.254.169.254). However, the implementation of this guard is conditionally gated, specifically checking if the deployment environment is identified as Google Cloud.\nWhen the reader detects it is not running on GCP, the private-address guard logic is bypassed, allowing requests to proceed to the underlying HTTP client without filtering the destination IP address. An attacker can exploit this by providing a target URL containing a hostname they control. By configuring this hostname's DNS records to point to a private IP or a sensitive cloud-native metadata endpoint, the attacker circumvents the guard. The application resolves the malicious hostname and initiates an outbound connection, effectively acting as a proxy for the attacker.\nThe attack flow proceeds as follows: 1) The attacker identifies the Jina AI reader endpoint. 2) The attacker crafts a request containing a hostname (e.g., attacker-controlled.com) that resolves to an internal target (e.g., 169.254.169.254 or an internal microservice on 127.0.0.1). 3) Because the service is not in a GCP environment, the private-address guard is inactive, and the reader performs an HTTP GET/POST request to the resolved internal destination. 4) The server receives the response from the internal resource and returns the result (e.g., instance identity tokens, internal configuration, or sensitive application state) to the attacker.\nThis SSRF allows for the exfiltration of sensitive information, such as IAM credentials or internal database contents, depending on the network architecture and available internal services. Since the vulnerability is a direct result of environmental configuration handling, the affected component is the internal request execution library or the URL validation module of the Jina AI reader. The lack of robust DNS-level filtering or network-level egress restrictions exacerbates the impact, as the service does not enforce blocklists based on the resulting IP of the hostname at runtime."
}