CVE-2026-5633

Medium

Published: 06 April 2026

Published

06 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v4 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0006 18.5th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5633 is a medium-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Supply Chain and Deployment risk domain.

The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-5633 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting assafelovic/gpt-researcher versions up to 3.4.3. The flaw exists in an unknown function of the "ws Endpoint" component, where manipulation of the "source_urls" argument triggers the forgery. Published on 2026-04-06, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

The vulnerability enables remote exploitation without authentication or user interaction. Attackers can send crafted requests to a vulnerable instance, potentially forging server-side requests to internal or external resources, leading to low-level impacts on confidentiality, integrity, and availability.

Advisories from VulDB and the project's GitHub repository (including issue #1696) indicate the issue was reported early to the maintainers, but they have not responded. No patches, workarounds, or official mitigations are detailed in the references.

The exploit has been publicly disclosed and may be utilized in attacks. Given gpt-researcher's focus on AI-driven research, the vulnerability is relevant to deployments involving AI/ML workflows.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-19190

Vulnerability details

A vulnerability was determined in assafelovic gpt-researcher up to 3.4.3. Affected is an unknown function of the component ws Endpoint. Executing a manipulation of the argument source_urls can lead to server-side request forgery. It is possible to launch the attack…

remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CWE(s): CWE-918

AI Security AnalysisAI

AI Category: AI Agent Protocols and Integrations
Risk Domain: Supply Chain and Deployment
OWASP Top 10 for LLMs 2025: None mapped
Classification Reason: Matched keywords: gpt

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF vulnerability in public-facing ws Endpoint component allows remote unauthenticated exploitation via crafted source_urls requests, directly enabling T1190 Exploit Public-Facing Application for initial access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1