CVE-2026-114064 in Snipe-IT
Summary
by MITRE • 10/21/2026
Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Snipe-IT versions prior to 8.7.0 represents a critical server-side request forgery flaw located within the webhook testing functionality. This security defect allows authenticated super-admin users, who possess high-level privileges within the application, to manipulate outbound HTTP requests initiated by the backend system. By exploiting this feature, an attacker can direct these internal server-side requests toward arbitrary destinations on the local network or private IP ranges defined in RFC1918, as well as loopback addresses that are typically inaccessible from external networks. This capability effectively transforms the vulnerable application into a proxy for network reconnaissance, enabling the enumeration of internal infrastructure services and hosts that would otherwise remain hidden behind firewalls or network segmentation controls.
The technical mechanism of this exploitation relies on the lack of strict input validation and URL scheme restrictions within the webhook testing module. When an administrator triggers a test webhook, the server constructs an HTTP request using user-supplied data without adequately sanitizing the target address. This oversight permits the inclusion of internal IP addresses or hostnames in the destination field. The attacker leverages this by crafting payloads that point to various ports on internal servers and analyzing the resulting HTTP status codes returned by Snipe-IT during the test execution phase. Specifically, a 4xx response typically indicates that the target host is reachable but may not have the specific service or endpoint listening on that port, whereas a 5xx response often signifies that the connection was refused or timed out because no service is present. By systematically varying the destination IP and port combinations and observing these distinct error responses, an attacker can map open ports and identify active services within the internal network topology.
From an operational impact perspective, this vulnerability facilitates significant lateral movement and reconnaissance activities for any compromised super-admin account. The ability to probe RFC1918 ranges allows attackers to discover critical infrastructure components such as database servers, internal APIs, or management interfaces that are not exposed to the public internet. This information is invaluable for planning further attacks, such as targeting specific services with known vulnerabilities or pivoting through trusted relationships between systems. Furthermore, because the exploitation requires super-admin privileges, it underscores a risk associated with over-privileged accounts; if an attacker gains control of even one high-level account due to credential theft or weak authentication practices, they can immediately begin mapping the internal network landscape without needing additional privilege escalation steps for this specific task.
This vulnerability aligns closely with CWE-918, which defines Server-Side Request Forgery (SSRF), specifically involving the ability to bypass access controls and target internal resources. It also maps to MITRE ATT&CK technique T1046, Network Service Discovery, where adversaries probe networks to identify active services and hosts for subsequent exploitation. The remediation strategy involves upgrading Snipe-IT to version 8.7.0 or later, which implements strict validation rules that restrict webhook destinations to allowlisted domains or prevent the use of private IP ranges entirely. Additionally, organizations should enforce principle of least privilege by ensuring that super-admin accounts are secured with multi-factor authentication and limited in number, thereby reducing the attack surface for this type of internal network mapping even if account credentials are compromised.