CVE-2026-0613

HIGH

The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behavior to perform GET requests to internal IP addresses and ...

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.4%
Percentile33th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The Librarian contains an internal port scanning vulnerability in the `web_fetch` tool, allowing SSRF-style GET requests to internal IP addresses and services, which can be exploited to scan the Hertzner cloud environment.

BSID: BS-2026-GLOBAL-059404-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-0613?
The Librarian contains an internal port scanning vulnerability in the `web_fetch` tool, allowing SSRF-style GET requests to internal IP addresses and services, which can be exploited to scan the Hertzner cloud environment.
What is the CVSS score for CVE-2026-0613?
CVE-2026-0613 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS: 0.4%.
Is CVE-2026-0613 actively exploited?
No confirmed active exploitation of CVE-2026-0613 as of 2026-05-30.
How do I remediate CVE-2026-0613?
Priority: HIGH.
What systems are affected by CVE-2026-0613?
CVE-2026-0613 affects Thelibrarian The Librarian.
Vulnerability Details
CVE IDCVE-2026-0613
BSIDBS-2026-GLOBAL-059404-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published2026-01-16
Last Modified2026-01-23
ICS Relevance15%
Weakness (CWE)
Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

The Librarian contains an internal port scanning vulnerability, facilitated by the `web_fetch` tool, which can be used with SSRF-style behavior to perform GET requests to internal IP addresses and services, enabling scanning of the Hertzner cloud environment that TheLibrarian uses. The vendor has fixed the vulnerability in all affected versions.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is facilitated by the `web_fetch` tool within The Librarian, which can be manipulated to perform SSRF attacks. This allows an attacker to send GET requests to internal IP addresses and services, potentially revealing sensitive information about the Hertzner cloud environment.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Thelibrarian The Librarian No version listed by source
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 272 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash28a056850d2537029bbed087b78fdeaca8daf5f2d0e770bd1e83dc4801b09df1631f17fca7492387b801f120ce28349cbf87e5898662583498ca938351bcd053
Related CVEs affecting Thelibrarian
CVE-2026-0612 7.5 The Librarian contains a information leakage vulnerability through the `web_f... CVE-2026-0616 7.5 TheLibrarians web_fetch tool can be used to retrieve the Adminer interface co... CVE-2026-0615 7.3 The Librarian `supervisord` status page can be retrieved by the `web_fetch` t...
View all Thelibrarian CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →