cve-2026-22874-gitea-ssrf-allowlist

CVE-2026-22874 — Incomplete SSRF protection in Gitea webhook and migration allow-list Technical writeup and references for CVE-2026-22874 GHSA-2r5c-gw76-rh3w: an incomplete SSRF allow-list in Gitea's webhook delivery and repository migration, fixed in Gitea 1.26.3. I independently reported this...

CVE-2026-111590

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

EUVD-2026-109830

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590

A wide range of Harbor versions are vulnerable to Server-Side Request Forgery (SSRF) due to a lack of validation on webhook target addresses. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy targeting private or link-local IP ranges. When a project event trig...

CVE-2026-111590

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-111590 SSRF in Harbor webhook delivery allows ProjectAdmin to reach internal services

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

PT-2026-123302

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-105689

The open-source design platform Penpot is vulnerable to Server-Side Request Forgery (SSRF) prior to version 2.18.0 . The root cause lies in the app.util.ssrf/blocked-address? component, which uses Java InetAddress predicates that fail to classify NAT64, 6to4, or Teredo addresses, applying CIDR ch...

CVE-2026-105689 Penpot: SSRF guard bypass via IPv6 transition addresses (NAT64/6to4/Teredo) in webhook delivery and media download

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, app.util.ssrf/blocked-address? relies on Java InetAddress predicates that do not classify NAT64, 6to4, or Teredo addresses and applies additional CIDR checks only to IPv4 values. Exploitation requires routing through a NAT...

CVE-2026-104973

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

EUVD-2026-92526

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

CVE-2026-104973 Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

PT-2026-106083

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description The webhook delivery task in apps/api/plane/bgtasks/webhook task.py uses the requests.post function without setting allow redirects=False and fails to validate redirect targets. While the validate url...

CVE-2026-104973: Server-Side Request Forgery (SSRF)

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-30242 validates webhook IP addresses only when the webhook is created in apps/api/plane/app/serializers/webhook.py. The delivery task in apps/api/plane/bgtasks/webhooktask.py performs a separate DNS resolution...

CVE-2026-105636: Server-Side Request Forgery (SSRF)

Plane is an open-source project management tool. Prior to 1.4.0, the webhook delivery task in apps/api/plane/bgtasks/webhooktask.py calls requests.post without allowredirects=False and does not validate redirect targets. validateurl blocks private, loopback, link-local, and reserved addresses in...

CVE-2026-56739

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and...

EUVD-2026-86224

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and...