What is CVE-2026-54157?

CVE-2026-54157 is a critical-severity vulnerability in Lobehub, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.0/10. Published 2026-06-23.

How severe is CVE-2026-54157?

Critical severity. CVSS v3 base score is 9.0 out of 10.

SSRF in Lobehub

CVE-2026-54157

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.018 (77.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H.

Affected products

Lobehub — versions < 2.1.57

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-54157?: CVE-2026-54157 is a critical-severity vulnerability in Lobehub, classified under Server-Side Request Forgery (SSRF). CVSS score: 9.0/10. Published 2026-06-23.
How severe is CVE-2026-54157?: Critical severity. CVSS v3 base score is 9.0 out of 10.