SSRF in unstructured's URL Partitioning Exposes Internal Services and Cloud Metadata (CVE-2026-71428)

A newly published GitHub Security Advisory (GHSA-4mvj-m6j5-pmf7) discloses a Server-Side Request Forgery vulnerability in the Python unstructured library, tracked as CVE-2026-71428 with a reported CVSS of 9.3. According to the advisory, the url= argument accepted by partition(), partition_html(), and partition_md() is fetched with requests.get() without any host validation — no checks for loopback, private, or link-local addresses, and no protection against redirect-based bypass. Because the fetched response body is parsed and returned as element text, the advisory characterizes this as a full-read SSRF: an attacker who controls the URL passed into partitioning can retrieve the contents of internal endpoints. The advisory states the three vulnerable sinks exist in unstructured == 0.22.26 and that the missing validation has been present since version 0.4.7 (February 2023) across roughly 219 releases. A working local proof-of-concept is included in the advisory, and the item is flagged as having a public PoC.

Why It Matters

unstructured is described in the advisory as a de facto URL ingestion layer used by LangChain's UnstructuredURLLoader, LlamaIndex's UnstructuredReader, Chainlit, and other agent/RAG frameworks. Any application that lets a user or upstream system supply a URL for document ingestion — a common pattern in LLM pipelines and document-processing services — may be passing attacker-influenced input directly into this vulnerable fetch path. Per the advisory, the practical impact includes reading internal HTTP services (admin consoles, internal Elasticsearch/Redis/Consul/etcd interfaces, Kubernetes API servers) and reaching cloud instance metadata endpoints on GCP, Azure, Oracle Cloud, DigitalOcean, and EC2 instances still relying on IMDSv1. The advisory notes EC2 instances enforcing IMDSv2-only are not directly exposed to credential theft via this SSRF, since IMDSv2 requires a PUT for token acquisition, though the endpoint can still be reached for reconnaissance. The advisory also describes internal network reconnaissance via connection timing/error behavior, and a missing timeout in partition_md() that could enable a slow-loris-style denial of service.

What Defenders Should Do Now

• Inventory applications and pipelines that call unstructured's partition(), partition_html(), or partition_md() functions with a url= argument, especially where that URL originates from user input or an untrusted upstream system.
• Check whether any LangChain, LlamaIndex, Chainlit, or other agent-framework integrations in your environment use unstructured's URL-based ingestion path, since the advisory identifies these as common downstream consumers.
• Until a patched release is available and confirmed, consider placing an egress proxy or allowlist in front of any service that performs URL-based partitioning, blocking requests to loopback, link-local (including 169.254.169.254 and metadata.google.internal), and RFC1918 address ranges, and disabling automatic redirect-following where feasible.
• Enforce IMDSv2-only on EC2 instances running affected workloads to reduce (though not eliminate) the impact of metadata-endpoint reconnaissance.
• Hunt for outbound requests from document-ingestion or RAG-pipeline hosts toward internal IP ranges or metadata endpoints in proxy, firewall, or VPC flow logs, particularly where the requesting process is a Python ingestion service.

Developing Intel

This advisory was published same-day and does not yet indicate whether a patched version of unstructured is available; check the advisory directly for updates on a fix and affected version ranges. This is a fast-moving disclosure and details may be refined — see the original GHSA for the authoritative record: GHSA-4mvj-m6j5-pmf7.