CVE-2026-82638: Jina-Ai Reader

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.

Affected products

• Jina-Ai Reader

Published 2026-08-30. Last modified 2026-09-01.