CVE-2026-27170

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. In versions 1.1.2-alpha and below, URL ingest allows overly permissive server-side fetch behavior and can be coerced into requesting unsafe targets. Potential access/probing of private/local network resources from the OpenSift host process when ingesting attacker-controlled URLs. This issue has been fixed in version 1.1.3-alpha. To workaround when using trusted local-only exceptions, use OPENSIFT_ALLOW_PRIVATE_URLS=true with caution.

Affected products

Openshift

Opensift

< 1.1.3

Fix

Available

CVSS 3.1

7.1 HIGH

EPSS

0.2% (8th percentile)

Weakness

CWE-20, CWE-918

NVD status

Analyzed

Published

2026-02-20

No exploit for CVE-2026-27170 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.