CVE-2026-3270: 
Java vulnerability analysis and mitigation

CVE-2026-3270 is a Server-Side Request Forgery (SSRF) vulnerability in PSI Probe, an open-source Apache Tomcat manager and monitoring tool. The flaw exists in the lookup() function of psi-probe-core/src/main/java/psiprobe/tools/Whois.java and affects all versions up to and including 5.3.0. It was disclosed publicly on February 26–27, 2026, with the vendor having been contacted prior to disclosure but not responding. The CVSS v3.1 base score is 8.8 (High) per NIST NVD, while the CNA (VulDB) rates it 6.3 (Medium) (VulDB PoC, Red Hat CVE).

The root cause is CWE-918 (Server-Side Request Forgery): the lookup() method in Whois.java (lines 124–130) parses ReferralServer values from whois responses and initiates new TCP socket connections to the specified host and port without validating whether the target is a trusted whois server. The entry point is the /whois.ajax?ip= endpoint (via WhoisController.java). An authenticated attacker with low privileges can register a domain whose whois record contains a malicious ReferralServer: whois:<internal-ip>:<port> header; when a user or the attacker queries that domain through PSI Probe, the server establishes a connection to the attacker-specified internal address. No user interaction beyond authentication is required (VulDB PoC).

Successful exploitation allows authenticated low-privilege attackers to use the PSI Probe server as a proxy to reach internal network resources that are otherwise inaccessible from external networks. Attackers can enumerate internal services and open ports (internal network scanning), interact with internal databases, administrative panels, or other services using the application server's trusted identity, and potentially exfiltrate data via the whois protocol tunnel. This impacts confidentiality (access to sensitive internal information), integrity (unauthorized interactions with internal services), and availability (excessive scanning may degrade server performance) (VulDB PoC, Red Hat CVE).

A proof-of-concept exploit was publicly disclosed on GitHub (February 15, 2026) by the reporter, though automated analysis of the PoC page found it contained only structural HTML with no directly visible exploit code. The EPSS score is approximately 0.034% (low probability of near-term exploitation). There is no confirmed evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. No vendor patch has been released as of the time of disclosure (VulDB PoC, Red Hat CVE).

1. Reconnaissance: Identify a target running PSI Probe version ≤ 5.3.0 that is accessible and requires only low-privilege authentication. Confirm the /whois.ajax endpoint is available.
2. Setup malicious domain: Register or control a domain and configure its whois record to include a ReferralServer entry pointing to an internal IP and port of interest, e.g., ReferralServer: whois:192.168.1.100:3306.
3. Authenticate to PSI Probe: Obtain a valid session cookie (JSESSIONID) by logging in with any low-privilege account.
4. Trigger the SSRF: Send an authenticated HTTP request to the whois endpoint querying the attacker-controlled domain:

   curl 'http://psi-probe:8080/whois.ajax?ip=attacker-domain.com' \
     -H 'Cookie: JSESSIONID=<session_token>'

5. Observe server behavior: Analyze the response or timing differences to determine whether the internal service at the specified IP and port is reachable (connection success vs. timeout/refusal).
6. Iterate for network mapping: Repeat with different ReferralServer values (varying IPs and ports) across multiple controlled domains to systematically map internal network topology and identify running services (e.g., SSH on port 22, MySQL on 3306, HTTP on 8080) (VulDB PoC).

• Network: Unexpected outbound TCP connections from the PSI Probe server to internal IP ranges (RFC 1918 addresses such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) on non-standard or service ports; repeated connections to varying internal hosts in short succession suggesting port scanning.
• Logs: Repeated HTTP requests to /whois.ajax?ip= with unusual or attacker-controlled domain names in application access logs; Java IOException or connection timeout stack traces in PSI Probe logs related to whois lookups targeting internal addresses.
• Process/Application: Whois lookup activity for domains not associated with legitimate administrative tasks; high frequency of whois queries from a single authenticated session.

No vendor patch is currently available, as the vendor did not respond to the disclosure. Recommended mitigations include: (1) Whitelist trusted whois servers — modify Whois.java to only follow referrals to known legitimate whois servers (e.g., whois.arin.net, whois.iana.org, whois.ripe.net); (2) Disable referral following — remove or comment out lines 126–130 in Whois.java to prevent the application from following ReferralServer responses entirely; (3) Network segmentation — restrict outbound connections from the PSI Probe server to only necessary external services; (4) Restrict access — limit the PSI Probe administration interface to trusted networks only; (5) WAF rules — deploy Web Application Firewall rules to detect and block SSRF attempts targeting the /whois.ajax endpoint; (6) Disable Whois feature — if not actively required, disable the Whois functionality entirely (VulDB PoC, Red Hat CVE).

Red Hat has published a CVE tracking page for CVE-2026-3270, indicating awareness within the enterprise Linux ecosystem. The vulnerability was assigned and disclosed via VulDB, and aggregated by multiple threat intelligence platforms including Vulners, CIRCL, and INCIBE-CERT. No notable public researcher commentary, vendor statements, or significant social media discussion has been identified beyond standard CVE aggregation activity.