CVE-2026-107394: Indico Incomplete Server-Side Request Forgery (SSRF) Check
Summary
CVE-2026-107394: Indico: Incomplete Server-Side Request Forgery (SSRF) check. Affects indico versions < 3.3.13. Fixed in 3.3.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Indico is an open-source event management software that allows users to create and manage events, including conferences and workshops. It provides various features such as registration, scheduling, and document management. However, due to its functionality that involves making outgoing requests to user-provided URLs, it is susceptible to vulnerabilities like Server-Side Request Forgery (SSRF), which can lead to unauthorized access to sensitive internal resources.
Vulnerability Detail
The vulnerability arises from Indico's handling of outgoing requests to URLs provided by users. While the software is designed to allow such requests, it inadvertently permits access to restricted targets, such as localhost or cloud metadata endpoints. This flaw was not fully addressed in a previous fix (CVE-2026-25738), allowing attackers to craft specific URLs that could exploit this oversight. The potential ramifications include unauthorized access to sensitive data and internal services, posing a significant security risk.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.3.13
This is the first release that contains the fix.
pip install --upgrade "indico==3.3.13"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If your Indico instance does not expose sensitive data without authentication, you may not be affected by this vulnerability. However, to enhance security, you can configure outgoing requests to go through a proxy by setting the following environment variables in your server configuration:
export http_proxy='http://your-proxy-server:port'
export https_proxy='http://your-proxy-server:port'
Ensure these variables are set for both the indico-uwsgi and indico-celery services.
Conclusion
CVE-2026-107394 represents a significant security risk for users of Indico due to its incomplete SSRF checks. It is essential to update to version 3.3.13 or later to mitigate this vulnerability. Additionally, implementing the suggested workarounds can provide extra layers of security while you prepare for the upgrade.
See every vulnerability recorded for indico →
FAQ
CVE-2026-107394 is a vulnerability in Indico that allows for incomplete Server-Side Request Forgery (SSRF) checks, potentially leading to unauthorized access to sensitive internal resources.
If you are using a version of Indico prior to 3.3.13, your installation may be vulnerable. You can check your version by running pip show indico in your terminal.
If an immediate upgrade is not possible, consider implementing the suggested workaround of using a proxy to limit outgoing requests and ensure that sensitive data is not exposed.
For more details, you can visit the Indico forum or contact the Indico team via email at indico-team@cern.ch.
The CVSS score for CVE-2026-107394 is 6.8, indicating a medium severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for indico.
