CVE-2026-35486

CVE-2026-35486 is a server-side request forgery (SSRF) vulnerability in text-generation-webui versions prior to 4.3, specifically affecting the superbooga and superboogav2 RAG extensions. These extensions fail to validate user-supplied URLs before fetching them via requests.get(), enabling attackers to access cloud metadata endpoints, steal credentials, and probe internal services. The vulnerability has been patched in version 4.3. The vulnerability carries a CVSS score of 7.5 (High) with a network-based attack vector requiring no authentication, user interaction, or special privileges. The attack complexity is low, and the impact is limited to confidentiality, allowing attackers to retrieve sensitive information such as IAM credentials and internal service data without affecting system integrity or availability. There is no current evidence of active exploitation in the wild. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities (KEV) catalog and is marked as inactive on the Hot List. The EPSS score of 0.00041 indicates this CVE is being exploited less frequently than the majority of published vulnerabilities, suggesting limited immediate threat despite its moderate FAUCET Risk Score of 47.0.