CVE-2026-30404

HighPublic PoC

Published: 19 March 2026

Published

19 March 2026

Modified

02 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0005 16.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-30404 is a high-severity SSRF (CWE-918) vulnerability in Wgstart Wgcloud. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents SSRF exploitation by validating and sanitizing user-supplied inputs to the wgcloud backend database management connection test feature.

SI-2 Flaw Remediation good match

prevent

Remediates the specific SSRF flaw in wgcloud v3.6.3 through timely identification, reporting, and correction via patching.

AC-4 Information Flow Enforcement good match

prevent

Enforces information flow control policies to block unauthorized server-initiated requests to internal networks or external malicious resources caused by SSRF.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

T1018 Remote System Discovery Discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

attack.mitre.org →

Why these techniques?

SSRF in public-facing connection test feature directly enables remote exploitation of the app (T1190); forces server-side file downloads from attacker locations (T1105); and permits internal network probing for hosts/services (T1046/T1018).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The backend database management connection test feature in wgcloud v3.6.3 has a server-side request forgery (SSRF) vulnerability. This issue can be exploited to make the server send requests to probe the internal network, remotely download malicious files, and perform other…

dangerous operations.

Deeper analysisAI

CVE-2026-30404 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, in the backend database management connection test feature of wgcloud version 3.6.3. Published on 2026-03-19T16:16:02.060, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a high-impact confidentiality risk from network-accessible exploitation with low complexity and no privileges required.

Unauthenticated remote attackers can exploit this SSRF flaw to manipulate the wgcloud server into issuing unauthorized requests. This enables probing of internal networks, remote downloading of malicious files to the server, and execution of other dangerous operations, potentially leading to unauthorized access to sensitive internal resources.

Advisories and further details, including potential mitigation guidance, are available in the referenced GitHub issues: https://github.com/TTTlw1024/qwe/issues/3 and https://github.com/tianshiyeben/wgcloud/issues/98.