CVE-2026-92566: Datageartech Datagear

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticated attackers to execute arbitrary HTTP requests by supplying a caller-controlled URI. Attackers can issue GET, POST, PUT, PATCH, or DELETE requests to internal endpoints and cloud metadata services, receiving full response bodies without authentication or validation.

Affected products

• Datageartech Datagear: up to and including 6.0.0

Published 2026-09-16. Last modified 2026-09-23.