medium · CVSS v3 5.5

CVE-2026-114064

Snipe-IT before 8.7.0 contains a server‑side request forgery in the webhook testing feature. Super‑admin users can use it to probe internal

Overview

Snipe-IT before 8.7.0 contains a server‑side request forgery in the webhook testing feature. Super‑admin users can use it to probe internal network addresses, including loopback and RFC1918 ranges. This allows mapping of internal hosts and open ports.

Description

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.

Impact

Confidentiality: attackers can discover internal host information. Integrity: mapping could aid further attacks. Availability: no direct impact. Super‑admin accounts are the only ones that can exploit, so internal administrators are at risk.

Remediation

Upgrade to Snipe-IT 8.7.0 or later. If upgrade is not possible, restrict super‑admin access to webhook testing or disable the feature. Monitor webhook logs for suspicious internal requests. Apply network segmentation to limit exposure.

Risk context

Medium severity CVE with no EPSS data. While not critical, it enables internal reconnaissance that can facilitate subsequent attacks. Defenders should address promptly.

Affected products

  • Snipe-IT

Scores

Severity
medium
CVSS v2
4.7
CVSS v3
5.5
CVSS v4
—
EPSS
—

Snipe-IT SSRF Webhook Internal Reconnaissance Medium ServerSideRequestForgery

← All CVEs

Related CVEs

medium

CVE-2026-114088

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retrieve decrypted run environment variables or send TASK_RUN_FAILED_TO_RUN and similar events to tamper with arbitrary runs.

View analysis

medium

CVE-2026-114065

Trigger.dev versions prior to 4.7.3 allow authenticated users to bypass tenant isolation by using placeholder table syntax in the query API. This can expose run metadata and payloads from other tenants. The vulnerability is a medium severity issue.

View analysis

medium

CVE-2026-114067

Trigger.dev versions 4.5.0 through 4.6.1 have an improper authorization flaw in the PUT snapshot-url session endpoint. Public session tokens can retrieve presigned S3 write URLs, allowing users to overwrite durable chat snapshots and forge conversation history. This can mislead agents and compromise data integrity.

View analysis

medium

CVE-2026-114070

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable session input records. Attackers holding a chat's public session token can read the in records endpoint to recover the token from payload.metadata.userActorToken and replay it for environment JWT exchange.

View analysis