CVE-2026-109189 | fit2cloud MeterSphere up to 3.6.9-lts Swagger3 Parser Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout swaggerUrl server-side request forgery

October 12, 2026 Yanac

A vulnerability has been found in fit2cloud MeterSphere up to 3.6.9-lts and classified as critical. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the component Swagger3 Parser. Performing a manipulation of the argument swaggerUrl results in server-side request forgery.

This vulnerability is known as CVE-2026-109189. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More