[Security] SSRF via unrestricted proxy endpoint (proxy.go:119)

[MuraveyApp]

Security Vulnerability Report

A Server-Side Request Forgery (SSRF) vulnerability exists in the proxy endpoint (proxy.go, line 119). User-controlled URL from JSON body is passed directly to http.NewRequest() without validation.

Impact: Cloud credential theft, internal network access.
CVSS: 7.7 (HIGH)

Full details sent to prithvi@h2o.ai and support@h2o.ai.

I am happy to provide more details or coordinate a fix.

[HakeemTheEmperor]

Hi. I wanted to confirm is this issue still unresolved.