What happened
Published/tracked in late Aug 2026 with CVSS 7.5 (High). jina-ai Reader is a widely-used content-extraction/web-fetching tool commonly plugged into RAG and LLM data-ingestion pipelines to convert web pages into LLM-consumable text.
Why it matters
Reader is designed to fetch attacker-influenced or arbitrary URLs on behalf of an LLM pipeline — exactly the SSRF-prone pattern RAG ingestion tools introduce. Any self-hosted deployment (the guard only works on GCP) is exposed to cloud-credential theft via metadata endpoints, directly compromising the hosting environment behind the AI application.
Attack vector
jina-ai Reader's private-address guard, meant to block SSRF to internal/cloud-metadata addresses, is only active on Google Cloud deployments. Self-hosted or non-GCP deployments disable this guard, letting an unauthenticated attacker supply a publicly-resolvable hostname that resolves to a private IP (e.g., 169.254.169.254) to retrieve cloud metadata or internal service content.
Affected systems
jina-ai/reader (self-hosted deployments)
Mitigation
Upgrade/patch when available; enforce the private-address guard regardless of hosting environment; deploy network-level egress controls blocking outbound requests to metadata IP ranges from the Reader service.