A high-severity SSRF vulnerability in the curl_cffi library allows unauthenticated attackers to query internal services, such as cloud metadata endpoints, by leveraging automatic redirects.

This vulnerability is a Server-Side Request Forgery (CWE-918) occurring because the library does not validate target URLs against internal IP ranges. An unauthenticated attacker can supply a malicious URL that redirects to sensitive internal infrastructure, utilizing the library's TLS impersonation feature to mimic legitimate browser traffic.

The ability to perform SSRF against internal services poses a significant risk to cloud environments, potentially leading to the unauthorized exfiltration of cloud metadata, credentials, or internal configuration data. With a CVSS score of 8.6, this flaw represents a high risk for organizations relying on the library for automated web requests, as it effectively bypasses perimeter security controls and may facilitate further lateral movement.

Immediate Action: Update the curl_cffi package to version 0.15.0 or later to ensure proper request validation and redirection handling.

Proactive Monitoring: Review application logs for unusual outbound requests originating from the server, particularly those targeting internal IP ranges or cloud metadata provider addresses (e.g., 169.254.169.254).

Compensating Controls: Implement strict egress filtering at the network level to prevent the application server from initiating connections to private IP address space and sensitive cloud management endpoints.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub (redyank/CVE-2026-33752).

Given the availability of a public proof-of-concept and the potential for severe information disclosure via cloud metadata access, organizations should prioritize updating the curl_cffi library immediately. Verify all applications using this dependency and transition to version 0.15.0 to remediate the underlying logic flaw and prevent unauthorized internal network access.