Description

Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to trigger requests to arbitrary URLs by supplying malicious media field values. Attackers can exploit download_image_from_url and fetch_content_sample functions which lack destination filtering and host validation to access internal services and cloud metadata endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T15:17:43.797Z",
  "pubdate": "2026-09-04T15:17:43.797Z",
  "executiveSummary": "A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in Marqo version 2.26.0 within the add_documents endpoint. The vulnerability stems from improper input validation during the processing of media field values, which are subsequently passed to backend utility functions responsible for fetching external content.\nThe flaw allows unauthenticated remote attackers to force the Marqo server to initiate outbound HTTP requests to arbitrary URLs. By manipulating the input data, an attacker can bypass network perimeters to interact with internal infrastructure, local services, or cloud-based metadata services (such as those hosted on 169.254.169.254).\nThis vulnerability poses a significant risk to confidentiality and internal network security. An attacker capable of exploiting this flaw can perform internal reconnaissance, port scanning, or exfiltrate sensitive data accessible only from the context of the Marqo server. Given that the endpoint does not require authentication, the attack vector is accessible to any remote party with network visibility to the Marqo API, requiring no specific credentials to initiate the malicious request chain.",
  "technicalDetails": "The vulnerability exists in the add_documents endpoint of Marqo 2.26.0, which processes documents containing media fields. The application logic triggers internal functions—specifically download_image_from_url and fetch_content_sample—to retrieve data from specified external sources. The root cause of the vulnerability is the absence of adequate destination filtering, allowlisting, or host validation mechanisms within these functions. Consequently, the application blindly trusts the user-supplied URL strings provided in the media fields.\nThe attack flow initiates when an unauthenticated attacker submits a crafted JSON payload to the add_documents endpoint. This payload includes a malicious URL as the value for a media-related field. When the backend service parses this document, it invokes download_image_from_url or fetch_content_sample using the attacker-controlled URI. Because the application logic lacks a blacklist of forbidden internal network ranges (e.g., 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or validation against internal metadata service endpoints, the underlying HTTP client library executes a request to the target destination provided by the attacker.\nThis mechanism allows the attacker to reach services that are typically protected by firewalls or network access control lists. In cloud environments, the most severe exploitation path involves targeting the cloud provider's Instance Metadata Service (IMDS). By crafting a request to the link-local address 169.254.169.254, an attacker can potentially retrieve sensitive instance credentials, IAM roles, or configuration data. Furthermore, the vulnerability can be leveraged to conduct blind SSRF attacks, using the response timing or error messages to determine the status of internal ports, thereby mapping the internal network topology from an external perspective.\nThe lack of authentication requirements at the add_documents endpoint significantly increases the risk, as it permits automated, wide-scale exploitation by any reachable entity. Since the server itself acts as the proxy for the requests, the traffic appears to originate from the trusted infrastructure, circumventing basic perimeter security controls and complicating the detection of malicious activity."
}