CVE-2026-0613 describes an internal port scanning vulnerability within The Librarian software, affecting all versions. This flaw, facilitated by the web_fetch tool, allows for Server-Side Request Forgery (SSRF)-style GET requests to internal IP addresses and services, specifically enabling scanning of the Hertzner cloud environment. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and low attack complexity, requiring no user interaction or privileges. It poses a high risk of confidentiality impact due to potential access to internal system data, though integrity and availability are not affected. While there is no evidence of active exploitation, Metasploit, Nuclei, or ExploitDB modules, the vulnerability has garnered significant community discussion with 11 mentions and one media article from CERT/CC. The vendor has released a fix for all affected versions.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:thelibrarian:the_librarian:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.