The vulnerability allows an attacker to send arbitrary URLs to an unauthenticated endpoint. Because the callback endpoint does not enforce authentication or validate the scheme or host of the supplied URL, an attacker can trigger requests to internal services, cloud metadata, or other network locations. The responses are stored in object storage under attacker‑supplied names, causing disclosure of potentially sensitive network information. The weakness is classified as CWE‑918, Server‑Side Request Forgery, which can lead to significant exposure of internal resources.

The affected product is Bisheng, all versions up to and including 2.6.0-fix2. Users operating these versions are at risk of exploitation unless remedial actions are taken.

The CVSS score of 8.8 indicates high severity. Although no EPSS score is available, the lack of authentication and absence of URL constraint make exploitation likely for an attacker with network reach to the vulnerable service. The vulnerability is not currently listed in the CISA KEV catalog, but its straightforward nature and high CVSS call for immediate attention. The attack vector is via unauthenticated POST requests to /api/v1/workflow/report/callback.