CVE-2026-73082

This SSRF flips the conventional attack model. Rather than an external attacker finding an exposed entry point, the attacker is already authenticated to the platform and using it as a trusted network pivot. Activepieces is a workflow orchestration engine designed to connect to external services on behalf of AI agents—its entire architectural purpose is outbound connectivity, which means the host's egress posture is inherently permissive. When an authenticated user probes 169.254.169.254 or equivalent metadata endpoints from that position, they're not exploiting a bug; they're using the platform as designed, sideways. The EPSS score of 0.00246 reflects low exploitation probability against external attackers, which misframes the actual risk. A compromised or malicious authenticated user—think departing contractor or compromised service account—gains immediate network reconnaissance capability against cloud internals without establishing any new foothold. The CVSS 5.3 is technically accurate for the mechanism but collapses a critical variable: the blast radius is entirely contingent on what credentials live on the Activepieces host. If Activepieces runs as a managed SaaS offering or in a containerized context without privileged IAM roles, the SSRF collapses to network reconnaissance against internal services—uncomfortable but not catastrophic. But self-hosted deployments that attach the platform to cloud IAM roles (the natural configuration to enable workflow integrations with AWS, GCP, or Azure) transform this into credential exfiltration with immediate privilege escalation. The metadata endpoint probe isn't reconnaissance in that context—it's a key to the kingdom. That's why patching to 0.82.0 is necessary but not sufficient. The fix must be paired with an architecture review: what credentials actually live on the Activepieces host, and is instance role attachment appropriate for this class of service? Verify whether your deployment uses a strict URL allowlist or relies on input sanitization that could be bypassed. If it's the latter, the architectural vulnerability persists in different form. Deployments with overprivileged IAM roles attached to the Activepieces host remain critically exposed even after patching.

Reviewed through automated stages and approved by a human before publication.