CVE-2026-82476

COMPONENT VERSION RANGE

NewScan fingerprints Memos from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-30 (/daily-cve). Version source is the tech_signatures "Memos" row added the same day (root-page template markers, then the gated /api/v1/instance/profile or /api/v1/workspace/profile document) - MEASURED on 0.24.0 and 0.30.0, see that note. Memos' link-metadata fetcher blocks the private ranges but not carrier-grade NAT, so an unauthenticated caller can point it at 100.64.0.0/10 and reach whatever the operator runs there - which on Alibaba Cloud includes the 100.100.100.200 instance-metadata service (vulncheck advisory). `le` and not `lt`: the advisory reads 'through 0.30.0', 0.30.0 is the newest GA (0.31.0-rc.1 is a pre-release) and no fixed version exists yet, so an `lt` would need a release number we would be inventing - and inventing one that turns out low fires this row on the patched build, which is worse than the miss. Revisit when the fix ships. Version-match only: proving the SSRF means making a stranger's server fetch an address we do not control the answer for, and our own in-band arm covers the same ground where it is provable - ssrf_tools.INTERNAL_PROBES already fetches http://100.100.100.200/latest/meta-data/ through the target and confirms on Alibaba's own metadata markers, so an affected Memos deployed on Alibaba is caught by the SSRF class check independently of this row.