CVE-2026-90769: Lfnovo Open-Notebook

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.

Affected products

• Lfnovo Open-Notebook: before 1.11.0 (fixed in 1.11.0)

Published 2026-09-13. Last modified 2026-09-24.