The critical thing to understand about CVE-2026-72560 is that it's not a typical SSRF vulnerability where developers simply overlooked a risk. The existence of SSRF_PROTECTION_ENABLED proves the developers understood this attack vector and built a mitigation for it—then deliberately set it to false by default. This transforms the vulnerability classification: it's a security-by-default design decision, not an oversight.
The 'authenticated user' prerequisite is technically accurate but practically hollow in Label Studio's typical deployment context. Label Studio sits at the integration seam between data pipelines and model training workflows, where authentication is routinely stretched thin to enable automated access. A service account with broad internal permissions is often what 'authenticated user' means in practice—not a hard security boundary.
The SSRF itself targets the cloud metadata endpoint (169.254.169.254), but the blast radius extends far beyond that. Since Label Studio typically touches training data, annotation outputs, and model serving configurations, an attacker who exploits this SSRF can probe the network topology of a system connected to high-value assets: Redis caches, S3 buckets storing unlabeled datasets, model registries, job queues executing training jobs. The CVSS of 6.5 completely misses this collateral damage potential. The severity isn't in the SSRF itself—it's in what the compromised instance can reach.
There's also a false mitigation trap: organizations that enabled SSRF_PROTECTION_ENABLED may believe they're protected, but the control likely dates from when SSRF was understood more narrowly. It was probably never retested against modern vectors like DNS rebinding, time-based oracle attacks on internal services, or HTTP/2 connection reuse attacks. Enabling an old control against a current deployment context isn't a fix—it's a ritual that creates dangerous complacency.
The fix isn't flipping a boolean. It's auditing what your Label Studio instance can reach, because the blast radius is determined by the integration topology, not the vulnerability in isolation.