CVE-2026-54166

Executive Summary

CVE-2026-54166 is a Server-Side Request Forgery (SSRF) vulnerability in Shelf, a platform for tracking physical assets, affecting versions prior to 1.20.3. An authenticated user holding the asset:import permission can bypass imageUrl validation in the Asset CSV Content Import feature and coerce the server into making unrestricted fetch() requests to attacker-controlled URLs. Successful exploitation enables access to internal network services and cloud metadata endpoints from the application's network context, with an additional memory exhaustion vector caused by response bodies being buffered before size validation.

Technical Analysis

The vulnerability resides in the Asset CSV Content Import feature of Shelf. Import processing accepts CSV content containing an imageUrl field that is intended to reference an image resource. Prior to version 1.20.3, the validation logic applied to imageUrl can be bypassed through several distinct techniques, as enumerated in the NVD description:

• Image-extension suffixes — appending an image file extension to a URL causes the validation check to treat the value as an image reference.
• Image-related path keywords — URLs containing image-related keywords in the path are accepted.
• Domain substring matching — validation based on substring matching of a domain can be satisfied by a crafted attacker-controlled domain that contains a permitted substring.
• Redirect chains — a URL that initially passes validation may redirect to an arbitrary destination.

Following validation, the server performs an unrestricted fetch() request to the supplied URL. Because the request is issued from the Shelf application's network context, the attacker can direct it toward internal addresses, loopback interfaces, cloud metadata endpoints, or arbitrary external hosts. This is the defining behavior of CWE-918 Server-Side Request Forgery: the application fails to restrict the destination of a server-initiated request.

Two impact dimensions follow from this design:

1. Confidentiality (CVSS C:H) — Responses to the forged request are returned through the import flow, allowing attackers to read internal services and metadata endpoints that should not be reachable from the user's position.
2. Availability (CVSS A:L) — Response bodies are fully buffered before size validation is applied. An attacker supplying a URL that returns a very large response can force excessive memory allocation, creating a potential memory exhaustion (denial-of-service) vector.

The vulnerability requires authentication and the asset:import permission (PR:L), with a network-accessible attack vector (AV:N), low attack complexity (AC:L), no user interaction (UI:N), and unchanged scope (S:U), yielding a CVSS 3.1 base score of 7.1 (High).

Note: The NVD description does not disclose the specific validation implementation (function names, parsing routines, or allowlist contents). Analysis above is limited to the mechanisms explicitly described in the advisory. No public PoC, exploit code, or Nuclei template is available for this CVE.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the techniques enumerated in the NVD description. No public PoC is available.

1. Reconnaissance / target identification. The attacker identifies a Shelf deployment accessible over the network. The attacker must possess a valid account and the asset:import permission, which may be obtainable through provisioning, a separate privilege-escalation weakness, or default/over-privileged roles. The attacker determines which URL-validation bypass technique applies by testing candidate values.

2. Triggering the flaw. The attacker crafts CSV content for the Asset CSV Content Import feature and populates the imageUrl field with a target URL. To bypass validation, the attacker applies at least one of: an image-extension suffix, an image-related path keyword, a domain string that satisfies substring matching against a permitted domain, or a benign URL that redirects to the target. The CSV is submitted through the import workflow.

3. Payload/execution at the vulnerability-class level. On processing, the server issues an unrestricted fetch() to the supplied URL. For SSRF confirmation the attacker directs the request at an internal service (e.g., loopback or RFC1918 address), a cloud instance metadata endpoint, or an attacker-controlled external host. For the memory exhaustion vector, the attacker points imageUrl at a URL returning a large response body, which the server buffers in full before applying any size check.

4. Post-exploitation impact. Depending on reachability, the attacker may read internal HTTP services, retrieve cloud instance credentials or configuration from metadata endpoints, port-scan internal hosts via response timing, or cause memory pressure leading to degradation or crash. Because responses are surfaced through the import result, exfiltration of the fetched body completes the SSRF exploitation.

Impact Assessment

• Business impact: An actor with a low-privileged, import-capable account can pivot from the application's trust boundary into internal networks and cloud infrastructure. Exfiltrated cloud metadata can yield credentials for lateral movement. Asset-tracking platforms often sit adjacent to operational networks, increasing blast radius.
• Affected systems: Self-hosted and managed Shelf deployments below version 1.20.3 that expose the Asset CSV Content Import feature.
• Blast radius: Scope is unchanged (S:U); the impact is contained to the vulnerable component's network position but can reach any host the Shelf server can route to.
• CVSS subscores: AV:N (remotely reachable), AC:L (no special conditions), PR:L (authenticated + asset:import), UI:N (no victim interaction), C:H (internal/metadata disclosure), A:L (memory exhaustion), base 7.1 High.
• EPSS: Not yet scored by FIRST.org.
• KEV: Not listed in CISA KEV.

Detection Guidance

Sigma Rule

title: Shelf Asset CSV Import SSRF Attempt via imageUrl Bypass
id: 9d3f7a12-4c81-4e5b-b7a2-1f6c8e0d2b44
status: experimental
description: Detects authenticated asset CSV import requests attempting SSRF via imageUrl validation bypass in Shelf < 1.20.3
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54166
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: shelf
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains: '/import'
  selection_ssrf_payload:
    cs-uri-query|contains:
      - 'imageUrl='
      - 'image_url='
  selection_internal_target:
    cs-uri-query|contains:
      - '169.254.169.254'
      - '127.0.0.1'
      - 'localhost'
      - '10.'
      - '192.168.'
      - '172.16.'
      - '0.0.0.0'
      - 'metadata.google.internal'
  condition: selection_endpoint and selection_ssrf_payload and selection_internal_target
falsepositives:
  - Legitimate internal image references from trusted admins
level: high
tags:
  - attack.t1190
  - cwe.918

YARA Rule

rule CVE_2026_54166_Shelf_SSRF_CSV_Import
{
    meta:
        description = "Detects CSV import payloads targeting Shelf Asset CSV Content Import SSRF (CVE-2026-54166)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54166"
        severity = "high"

    strings:
        $col = "imageUrl" ascii nocase
        $csv = ".csv" ascii nocase
        $meta1 = "169.254.169.254" ascii
        $meta2 = "metadata.google.internal" ascii
        $meta3 = "metadata" ascii nocase
        $local1 = "127.0.0.1" ascii
        $local2 = "localhost" ascii
        $local3 = "0.0.0.0" ascii

    condition:
        uint32(0) != 0x504B0304 and
        filesize < 5MB and
        $col and
        (
            any of ($meta*) or
            any of ($local*)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54166 Shelf Asset Import SSRF Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"import"; http.request_body; content:"imageUrl"; http.request_body; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|localhost|metadata\.google\.internal|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+)/i"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-recon; reference:cve,2026-54166; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-54166; sid:202654166; rev:1;)

Elastic Detection

sequence by user.name
  [ network where http.request.method == "POST" and
      url.path : "*import*" and
      http.request.body.content : "*imageUrl*" ]
  [ network where destination.ip : ("127.0.0.1", "169.254.169.254", "0.0.0.0") or
      destination.ip : "10.0.0.0/8" or
      destination.ip : "192.168.0.0/16" or
      destination.ip : "172.16.0.0/12" ]

Splunk SPL Query

index=web sourcetype=shelf:access
| search method=POST uri_path="*import*"
| rex field=request_body "imageUrl=(?<image_url>[^&,\s]+)"
| where match(image_url,"(?i)(169\.254\.169\.254|127\.0\.0\.1|localhost|metadata\.google\.internal|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+)")
| stats count values(image_url) as urls by src_ip user
| where count >= 5

Wazuh OSSEC Rule

<group name="web,shelf,cve-2026-54166,">
  <rule id="202654166" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="url">import</field>
    <regex type="pcre2">(?i)imageUrl=[^&]*(169\.254\.169\.254|127\.0\.0\.1|localhost|metadata\.google\.internal|10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+)</regex>
    <description>CVE-2026-54166: Shelf asset CSV import SSRF attempt detected</description>
    <mitre>
      <id>T1190</id>
      <id>T1552.005</id>
    </mitre>
    <group>cwe_918,ssrf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict/remove the asset:import permission from all users except a small, audited group.
   • Apply outbound egress filtering on the Shelf host: block RFC1918 ranges, loopback, link-local (169.254.0.0/16), and cloud metadata endpoints (169.254.169.254, fd00:ec2::254) from the application.
   • Enforce IMDSv2 (token-required) on AWS workloads to blunt metadata retrieval.
   • Place Shelf behind a forward proxy that rejects requests to internal destinations, and rate-limit import endpoints.

2. Patch/upgrade steps

   • Upgrade to Shelf 1.20.3 or later, which the advisory states patches the issue.
   • Verify the fix within your deployment: confirm imageUrl validation rejects redirects, internal addresses, and non-image targets, and that response bodies are size-checked before buffering.
   • Because no patch artifact is confirmed in tracked sources, independently validate the vendor-supplied release before relying on it.

3. Long-term hardening

   • Implement strict allowlisting for imageUrl (exact permitted hosts, not substring matches) and resolve-then-validate final redirect destinations.
   • Stream responses with a hard byte cap and a short timeout to prevent memory exhaustion.
   • Adopt an SSRF-resistant HTTP client that resolves and blocks private/reserved IP ranges by default.
   • Update SBOM/dependency tracking and monitor NVD for further Shelf advisories.

References

• NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-54166
• Shelf project release notes (1.20.3) — vendor advisory for the patched version
• OWASP — Server-Side Request Forgery Prevention Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
• MITRE ATT&CK — T1190 Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-54166 not listed)

Threat actor campaigns / ITW: No exploit-in-the-wild evidence, no public PoC, and no CISA KEV listing are associated with CVE-2026-54166 at the time of writing. EPSS has not yet been scored. Patch confidence remains 0/4.