CVE-2026-30118
Scalar/astro v0.1.13 contains a critical Server‑Side Request Forgery (SSRF) that lets attackers make the backend server send HTTP requests to any URL, potentially exposing authentication cookies and escalating privileges.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running Scalar/astro version 0.1.13 (and earlier releases that include the vulnerable Scalar Proxy endpoint).
Real-world impact
An attacker can force the server to contact attacker‑controlled URLs, leaking credentials and headers and possibly gaining higher privileges on the affected system.
Why this severity
The CVSS score of 9.8 reflects the vulnerability’s high impact on confidentiality, integrity, and availability, combined with the fact that it can be exploited remotely without authentication or user interaction.
What to do about it
- ›Disable or remove the Scalar Proxy endpoint until a patch is released.
- ›Restrict outbound network traffic from the server to trusted destinations only.
- ›Apply network segmentation to isolate the server from sensitive internal resources.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 19, 2026 · May 19, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.