CVE-2026-118172 in Strapi
Summary
by MITRE • 10/27/2026
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in strapi/strapi, specifically within the Core Admin Webhook Runner component, represents a significant server-side request forgery (SSRF) risk that exploits the framework's automated handling of HTTP redirects. This flaw allows an attacker who has control over webhook configuration or input to manipulate outbound network requests initiated by the Strapi application. The core technical deficiency lies in the webhook dispatcher's implementation of HTTP client behavior, which automatically follows redirect responses without implementing critical security checks on the final destination URL. In a secure architecture, any redirection should trigger a re-evaluation of the target endpoint against strict allowlists and blocklists to ensure it does not point to internal infrastructure or local services. However, in this vulnerable version, once an initial request is made, subsequent redirects are followed blindly based solely on the Location header provided by the intermediate server, bypassing any validation logic that would normally inspect the IP address of the final target.
This semi-blind SSRF mechanism operates through a specific sequence where the attacker provides a URL pointing to a controlled or malicious intermediary endpoint. When Strapi processes this webhook trigger, it sends an HTTP request to the provided URL. If the intermediate server responds with a redirect status code such as 301 Moved Permanently or 302 Found, the client library automatically issues a new request to the URL specified in the Location header. Crucially, the application fails to perform post-redirect IP resolution checks against RFC1918 private address ranges (such as 10.x.x.x, 172.16.x.x–172.31.x.x, and 192.168.x.x) or link-local addresses like 169.254.x.x. This omission means that if the redirect points to an internal service running on localhost (e.g., http://localhost:6379 for Redis or http://127.0.0.1:27017 for MongoDB), Strapi will successfully connect to and interact with these sensitive internal resources from within its own network context, effectively bypassing external firewall rules that might otherwise protect them.
The operational impact of this vulnerability is severe because it enables unauthorized access to internal services that are not exposed to the public internet but are accessible from the server hosting Strapi. An attacker can leverage this vector to scan internal networks, exfiltrate data from unprotected databases, or interact with management interfaces for cloud metadata services such as AWS EC2 instance metadata (http://169.254.169.254), potentially leading to full compromise of the underlying infrastructure if combined with other vulnerabilities like insecure deserialization or credential leakage. Furthermore, because non-2xx responses from these target endpoints are captured and reflected directly back to the caller, this flaw also facilitates a blind SSRF variant where error messages or status codes can be used as an out-of-band channel to confirm successful exploitation even when no direct data is returned in the response body. This capability transforms what might otherwise be a simple connectivity check into a powerful reconnaissance tool for mapping internal network topologies and identifying vulnerable services.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically falling under subcategories related to insufficient validation of redirect targets and lack of IP address verification. It also maps to MITRE ATT&CK technique T1571.002 Non-Standard Port, as attackers may use this vector to reach services on non-standard internal ports that are typically filtered by perimeter defenses. The reflection of error responses further complicates detection, as it provides feedback loops that aid in exploitation refinement. To mitigate this risk, immediate action is required to update the strapi/strapi package to a patched version where the webhook runner has been hardened against redirect-based SSRF attacks. In environments where an upgrade is not immediately feasible, network-level controls should be implemented to restrict outbound HTTP traffic from Strapi servers to only known external domains and block access to RFC1918 address ranges at the firewall or proxy level. Additionally, application-layer mitigations such as implementing a strict allowlist for webhook destinations and disabling automatic redirect following unless explicitly required by business logic can significantly reduce the attack surface associated with this vulnerability.