CVE-2026-58612

CVE-2026-58612 is a server-side request forgery (SSRF) in PowerShell Core's Invoke-WebRequest and Invoke-RestMethod cmdlets, carrying a CVSS 7.4 that reflects its contextual nature rather than trivial exploitability. The vulnerability activates when these cmdlets process untrusted input — typically URLs or endpoint parameters passed from user-adjacent sources into automation scripts, pipelines, or configuration workflows. The 7.4 score is informative: this isn't a one-click remote execution; it requires the specific condition where developer automation meets external input without validation. That's precisely the pattern that proliferates under deadline pressure, where 'make this work' scripts evolve into production pipelines fetching configuration from user-provided sources. What makes this significant is what's at stake when exploitation succeeds. PowerShell Core is the automation backbone across Windows, Linux, and macOS — running in CI/CD pipelines, cloud-init scripts, container entry points, and DSC configurations. A successful SSRF doesn't just 'read a webpage.' It reaches the AWS metadata endpoint at 169.254.169.254, Azure IMDS, internal service discovery APIs, and Chef/Puppet bootstraps. One SSRF in a credential-rich automation context becomes the entry point for cloud credential chaining and full infrastructure compromise. The blast radius far exceeds what the CVSS score communicates. The root cause traces to design choices Microsoft made during the Windows PowerShell 5.1 to Core cross-platform port. Legacy validation assumptions that were never stress-tested in containerized, cross-platform environments got carried forward. The cmdlets make HTTP requests ergonomically frictionless — that's the feature — but they provide no structural guidance toward safe input handling. Microsoft could warn when Invoke-WebRequest receives pipeline input from untrusted sources, log outbound requests made with external parameters, or ship example patterns for safe validation. Instead, the entire burden falls on developers to recognize SSRF as a threat in their specific context. For defenders: audit automation scripts, pipelines, and workflows that invoke Invoke-WebRequest or Invoke-RestMethod with any parameter sourced from outside the trusted codebase. Validate and constrain URLs before passing them to these cmdlets — allowlist schemes, hosts, and ports where possible. Prioritize cloud-environment automation where the metadata endpoint exposure is highest. The patch addresses this instance, but the class of vulnerability recurs whenever platforms make HTTP ergonomics frictionless without teaching developers the attack surface they're opening.

Reviewed through automated stages and approved by a human before publication.