JobOps up to version 0.13.1 contains a server‑side request forgery flaw in the POST /api/manual-jobs/fetch endpoint. The bug allows an attacker to supply arbitrary URLs in the request body; the server then issues outbound HTTP requests to those URLs and returns the response content. This behavior enables the disclosure of instance metadata, internal service data, and any other reachable internal endpoint. The weakness is catalogued as CWE‑918.

Any deployment of DaKheera47 JobOps that accepts POST requests to /api/manual-jobs/fetch is vulnerable. The flaw exists in all releases up to and including v0.13.1. Whether the user is authenticated or operating in the unauthenticated demo mode, the vulnerability can be exercised. Administrators should verify their installed version and ensure it is newer than 0.13.1.

The CVSS score of 7.1 indicates medium severity and the EPSS score of less than 1% indicates a very low but non‑zero likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Because it can be triggered by anyone with API access, the potential for confidentiality and integrity compromise is significant, especially in externally exposed deployments. Attackers can target loopback, RFC1918, or cloud‑metadata addresses to read sensitive data; authenticated users could further manipulate job operations through the same mechanism.