Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address (CVE-2026-79788) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-79788

Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address

Answer in brief

CVE-2026-79788 records a Unknown severity vulnerability in Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Address. The current sources do not mark it as known exploited. The current feed maps dradis/dradis-ce (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 25, 2026Updated Aug 25, 2026Source checked Aug 25, 2026First seen by HOL Aug 25, 2026Material review Aug 25, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps dradis/dradis-ce (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
dradis/dradis-cegeneric	>=5.1.0 <5.3.0	5.3.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for dradis/dradis-ce.
Review the reported fix. Update dradis/dradis-ce to 5.3.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 25, 2026

Sources and claim methodology

Upstream source description

In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169.254.169.254) and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server issues a request to the attacker-supplied URL (server-side request forgery). For non-2xx responses, the target's response body is reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, making the SSRF readable.

Quoted source text, attributed separately from HOL analysis.