Impact
Affected LobeHub deployments expose the /webapi/proxy route without authentication [S2]. The route can make outbound requests to attacker-selected external destinations and return the upstream response. The upstream advisory also describes response-header and cookie-injection impact, but FixVibe does not reproduce those behaviors during a scan.
Root Cause
In affected releases, the proxy route was not wrapped in the authentication check used by other LobeHub web API routes [S2]. LobeHub's URL-fetch helper includes private-address protections, so FixVibe does not claim that a callback result proves access to cloud metadata, localhost, or an internal network.
Technical Details
- Vulnerability Type: Server-Side Request Forgery (SSRF) [S1]
- Affected Endpoint:
POST /webapi/proxy[S2] - Affected Versions: Up to and including 2.1.56 [S2]
- Fixed Version: 2.1.57 [S2]
- CVE ID: CVE-2026-54157 [S1]
How FixVibe covers it
For a verified active scan, FixVibe submits a FixVibe-controlled benign external callback URL to the exact /webapi/proxy route without credentials. A finding is reported only when FixVibe directly observes the target fetch that URL or return the known callback body.
The finding is reported as a high-confidence confirmed exposure with high severity. It confirms an unauthenticated external proxy behavior associated with CVE-2026-54157. It does not claim that FixVibe verified the installed LobeHub version, private-network access, cloud-metadata access, reflected cookies, session fixation, or secret exposure. FixVibe never sends internal-address or metadata-service destinations for this check.
Fix
Upgrade LobeHub to 2.1.57 or newer and restart the deployed service [S2]. Confirm that /webapi/proxy requires authentication or is removed. During rollout, restrict the LobeHub interface to trusted networks or authenticated reverse-proxy access, and review access logs for unexpected proxy requests.