The vulnerability lies in Dataease SQLbot versions up to 1.6.0, specifically in the get_es_data_by_http function within the Elasticsearch handler. By manipulating the address argument, an attacker can cause the application to perform unauthorized HTTP requests to internal or external resources, leading to potential data exposure or manipulation of internal services. The flaw is publicly disclosed and can be exploited from a remote location.

Dataease SQLbot is the affected product. All releases from the first public version through 1.6.0 contain the vulnerability. The vendor recommends upgrading to version 1.7.0 to eliminate the issue.

The CVSS score of 5.1 indicates a medium severity risk. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The description states that the attack may be initiated remotely; no requirement for user authentication is explicitly required to trigger the SSRF. Because the exploit is publicly disclosed, vulnerable installations could become targets of opportunistic attackers.