LiveActive security incident?Get immediate response
CVE Record

CVE-2026-17552: Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain string, the REQUEST_URI is appended to it, with no check that the path starts with a forward slash ('/'). When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component. For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://example.com@192.168.1.2/", with the rendered content returned to the attacker. This allows an attacker to access internal or restricted hosts that only the webserver has access to.

CriticalCVSS 9.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A flaw in Plack::App::Prerender before 0.3.0 can make a public web server retrieve content from internal or restricted systems. An unauthenticated attacker may receive that content, creating serious confidentiality and integrity risk where the component is deployed with the vulnerable string-based rewrite configuration.

Executive priority

Treat internet-facing vulnerable deployments as an immediate remediation priority. Upgrade promptly and investigate potential internal access through affected servers. Systems without the package or vulnerable configuration are not shown to be exposed, so confirm inventory and configuration before assigning incident scope.

Technical view

CVE-2026-17552 is an SSRF vulnerability caused by concatenating an unvalidated REQUEST_URI with a plain-string rewrite base. A specially formed request target can reinterpret the intended destination hostname through RFC 3986 userinfo parsing. The issue is rated CVSS 3.1 9.1 and classified as CWE-918.

Likely exposure

Exposure requires Plack::App::Prerender earlier than 0.3.0 and a plain-string rewrite base, particularly one without a path. Internet-facing deployments with network access to internal services face the greatest risk. The supplied evidence does not establish how widely this package or configuration is deployed.

Exploitation context

The flaw is remotely reachable with low complexity, requires no privileges or user interaction, and may expose services reachable only by the web server. The source bundle says the CVE is not in KEV and provides no evidence of active exploitation.

Researcher notes

The security boundary failure occurs before outbound retrieval: REQUEST_URI is appended without enforcing a leading slash. URI parsing can consequently change the authority rather than only the path. Review the linked patch for the authoritative code change. Available evidence establishes impact and remediation but not observed exploitation prevalence.

Mitigation direction

  • Upgrade Plack::App::Prerender to version 0.3.0 or later.
  • Review the vendor advisory and release notes before deployment.
  • Restrict the web server's outbound access to required destinations.
  • Temporarily disable affected prerendering configurations if upgrading cannot occur promptly.

Validation and detection

  • Inventory installed Plack::App::Prerender versions across production and development systems.
  • Identify deployments using a plain-string rewrite base, especially one without a path.
  • Confirm upgraded systems report version 0.3.0 or later.
  • Review request and outbound-connection logs for unusual destinations or malformed request targets.
  • Verify network controls prevent the web server from reaching unnecessary internal services.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-918: Information exposure and cloud metadata lookup

Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-17552 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.1 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: yesTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.1CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

9.1Critical
CVSS 3.1 vector shape for CVE-2026-17552Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
RRWOPlack::App::PrerenderPlack-App-Prerender, 0unaffected
Weakness

CWE details

CWE-918

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.