Cyber Resilience

CVE-2025-70042

Critical

Published: 09 March 2026

Published
09 March 2026
Modified
18 March 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0033 24.9th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-70042 is a critical-severity SSRF (CWE-918) vulnerability in Opensourcelabs Thermakube. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-70042 is a Server-Side Request Forgery vulnerability (CWE-918) discovered in the master branch of ThermaKube, a project developed by oslabs-beta. Published on 2026-03-09T16:16:15.480, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

The vulnerability enables exploitation by any remote network-accessible attacker with no required privileges, low attack complexity, and no user interaction. Successful exploitation grants high impacts across confidentiality, integrity, and availability without scope changes, allowing attackers to potentially manipulate server-side requests in ways that compromise the affected ThermaKube instance.

Mitigation details and further technical information are available in the provided references, including a Gist at https://gist.github.com/zcxlighthouse/5a6d15611456de619e4be36f7d2a0ee7, the oslabs-beta organization page at https://github.com/oslabs-beta, and the ThermaKube repository at https://github.com/oslabs-beta/ThermaKube.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SSRF in public-facing ThermaKube web app directly enables remote exploitation without auth (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-13195Shared CWE-918
CVE-2026-5052Shared CWE-918
CVE-2025-58045Shared CWE-918
CVE-2025-69299Shared CWE-918
CVE-2026-42398Shared CWE-918
CVE-2026-7025Shared CWE-918
CVE-2025-2691Shared CWE-918
CVE-2025-21385Shared CWE-918
CVE-2026-6625Shared CWE-918
CVE-2026-30118Shared CWE-918

Affected Assets

opensourcelabs
thermakube
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the SSRF vulnerability in ThermaKube by identifying, reporting, and correcting the flaw through timely patching.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes untrusted inputs used to construct server-side requests, preventing attackers from forging requests to unauthorized internal or external resources.

SC-7 Boundary Protection good match
preventdetect

Monitors and controls communications at system boundaries to block unauthorized outbound requests triggered by SSRF exploitation.

References