VDB

CVE-2026-30832

CVE-2026-30832 PUBLISHED CVSS 9.100000381469727 CRITICAL

soft-serve vulnerable to SSRF via unvalidated LFS endpoint in repo import

EPSS 0.02% · 7.2th percentile

Risk Scores

CVSS v3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS Score
0.02%
7.2th percentile

Affected Products

VendorProductVersions
github.comcharmbracelet/soft-serve0.6.0, 0.6.0
charmsoft_serve0.6.0, 0.6.0
charmbraceletsoft-serve>= 0.6.0, < 0.11.4, >= 0.6.0, < 0.11.4

Timeline

  • Mar 6, 2026 CVE Published
  • Mar 7, 2026 PoC Published
  • Mar 7, 2026 PoC Published
  • Mar 8, 2026 EPSS Score
  • Mar 8, 2026 PoC Published
  • Mar 9, 2026 CVE Updated
  • Mar 9, 2026 EPSS Score
  • Mar 10, 2026 EPSS Score
  • Mar 10, 2026 Security Advisory
  • Mar 11, 2026 EPSS Score
  • Mar 12, 2026 EPSS Score
  • Mar 13, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›