CVE-2026-50775

CVE-2026-50775 is a blind server-side request forgery in a DataHub image retrieval feature. The 'blind' qualifier is the critical detail: the server fetches a URL but returns no content and logs nothing on failure. This isn't a minor variant — it fundamentally changes the risk calculus. When developers treat URL fetching as a throwaway utility operation ('just pull this image, we don't use the result'), they skip URL validation, allowlisting, and output handling entirely. The security implications of the network call become invisible to the developer because there's no observable output to scrutinize. That's the design failure: the HTTP client itself becomes an attacker-controlled asset, and the fetch operation executes with the server's full network trust. What makes this particularly dangerous is the blast radius problem. Standard risk frameworks assume you can rank vulnerabilities by expected damage — blind SSRF breaks that assumption. A conventional SSRF with returned content at least tells you what was accessed. A blind SSRF on a cloud-hosted service with access to internal metadata endpoints (169.254 addresses) is operationally unbounded: you cannot enumerate what was fetched, cannot issue credential rotations with confidence, and cannot declare the incident closed even after patching. For defenders, three priorities: First, immediately determine the DataHub server's network posture — what internal services, databases, and cloud metadata endpoints can it reach? If it runs on AWS, GCP, or Azure with an IAM role, treat credential rotation as mandatory, not optional. Second, audit all URL-fetching operations across the codebase for the same pattern: HTTP clients used as side effects without validation. Third, recognize that this vulnerability likely existed in forgotten code written during 'make it work' phases with minimal security review — the same pattern that recurred in Capital One in 2019. The fix isn't just URL validation; it's ensuring your code review process treats every HTTP client as a security boundary, regardless of how trivial the operation seems. The EPSS score of 0.00241 reflects automated tooling's inability to catch this — static analysis sees an HTTP library call but cannot infer that a fetch operation with no observable output is security-relevant. That gap requires semantic, taint-aware analysis that most scanners treat as out of scope.

Reviewed through automated stages and approved by a human before publication.