VDB

CVE-2026-30832

CVE-2026-30832 PUBLISHED CVSS 9.100000381469727 CRITICAL

soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import

EPSS 0.41% · 34.0th percentile

Risk Scores

CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS Score
0.41%
34.0th percentile

Affected Products

VendorProductVersions
github.comcharmbracelet/soft-serve0.6.0, 0.6.0
charmsoft_serve0.6.0, 0.6.0
charmbraceletsoft-serve>= 0.6.0, < 0.11.4, >= 0.6.0, < 0.11.4

Timeline

  • Mar 6, 2026 CVE Published
  • Mar 7, 2026 PoC Published
  • Mar 7, 2026 PoC Published
  • Mar 8, 2026 EPSS Score
  • Mar 8, 2026 PoC Published
  • Mar 9, 2026 CVE Updated
  • Mar 10, 2026 EPSS Score
  • Mar 10, 2026 Security Advisory
  • Mar 12, 2026 EPSS Score
  • Mar 14, 2026 EPSS Score
  • Mar 16, 2026 EPSS Score
  • Mar 17, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›