CVE-2024-32965 - CVE House
Back to Database
Status published High CVE-2024-32965

ssrf vulnerability in lobe-chat

Vulnerability Description

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32965

Credits & Attribution

No credits recorded in the NVD database.

References

More from lobehub

View All →
CVE-2025-62505
SSRF in lobehub/lobe-chat with native web fetch module
Low 3
CVE-2025-59426
lobe-chat has an Open Redirect
Medium 4.3
CVE-2025-59417
Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
Medium 6.8
CVE-2024-47066
Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
Critical 9
CVE-2024-37895
API Key Leak in lobe-chat
Medium 5.7

Affected Vendor

Affected Software

lobe-chat
Vulnerable Versions:
< 1.19.13

Timeline

Official Publish: November 26th, 2024
Last Modified: November 26th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery