MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Magicmirrororg |
|
No data.
No data.
References
History
Fri, 15 May 2026 11:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Magicmirrororg
Magicmirrororg magicmirror |
|
| Vendors & Products |
Magicmirrororg
Magicmirrororg magicmirror |
Thu, 14 May 2026 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment variable placeholders (**VAR_NAME**), enabling exfiltration of server-side secrets. This vulnerability is fixed in 2.36.0. | |
| Title | MagicMirror²: Unauthenticated SSRF via /cors endpoint | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-14T19:51:14.186Z
Reserved: 2026-04-26T12:13:55.550Z
Link: CVE-2026-42281
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-05-14T16:16:21.200
Modified: 2026-05-14T20:17:04.560
Link: CVE-2026-42281
Redhat
No data.