LF Edge eKuiper SSRF vulnerability patched in v2.4.0

LF Edge eKuiper has addressed a server-side request forgery (SSRF) vulnerability in its external service feature as detailed in a GitHub Security Advisory. Prior to version 2.4.0, eKuiper did not validate destination IP addresses for external service registrations and HTTP invocations. This allowed attackers with access to the management API to register services pointing to internal network locations, such as localhost or cloud metadata endpoints, and execute queries that could probe internal networks or interact with sensitive APIs.

The remediation introduced in version 2.4.0 enables SSRF protection by default, blocking requests to private, loopback, link-local, multicast, and unspecified IP addresses. Operators are advised to upgrade to this version to mitigate the vulnerability. For those running versions prior to 2.4.0, no effective workaround is available, making the upgrade essential.

Before upgrading, operators should verify whether any existing rules or external service configurations rely on access to private or loopback addresses. The new SSRF protection may block such configurations, potentially disrupting workflows that were previously functional. This pattern of tightening network security controls is increasingly common across projects, reflecting a broader industry shift toward minimizing exposure to internal resources.