CVE-2026-63004 in Unleash
Summary
by MITRE • 08/21/2026
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
Unleash serves as a prominent open-source platform for managing application features through dynamic configuration and toggling mechanisms. The vulnerability identified within this ecosystem stems from an insecure server-side request forgery flaw located in the addon and integration subsystems. Specifically, the issue resides in how the system handles user-supplied input during webhook processing and various third-party integrations such as Slack, Microsoft Teams, Datadog, and New Relic. When a user configures these integrations, they provide a URL value that is subsequently passed to an internal function responsible for retrying failed requests. This architectural design fails to implement adequate validation on the destination address before initiating outbound network connections from the server itself.
The core technical flaw involves the lack of restrictions on loopback addresses like 127.0.0.1, link-local ranges, private IP spaces such as those defined in RFC 1918, and cloud metadata endpoints commonly used for instance identity verification. By allowing these internal or sensitive network destinations to be specified by an authenticated user with root-level permissions to create or update addons, the application effectively bypasses standard perimeter security controls. This behavior classifies the vulnerability under CWE-918, which addresses Server-Side Request Forgery where a web server makes requests on behalf of a client without proper validation of the target address. The absence of an allowlist for outbound connections means that any URL provided by the attacker is treated as valid and executable by the backend service.
The operational impact of this vulnerability is severe due to the high privilege level required, specifically root CREATE_ADDON or UPDATE_ADDON permissions. An authenticated actor possessing these privileges can manipulate the server into sending HTTP requests from within its trusted network boundary. This capability allows for several malicious outcomes including blind probing of internal services where response differences indicate service availability without requiring direct feedback in the application interface. Furthermore, because the system forwards sensitive authentication headers such as Authorization tokens, customHeaders, and API keys like DD-API-KEY to the specified destination, an attacker can exfiltrate these credentials by directing requests to a host they control. This constitutes CWE-200 where information exposure occurs through unintended data leakage via outbound channels.
Additionally, the vulnerability enables the delivery of feature-event JSON bodies to internal services that may not be designed to handle such external inputs securely. This could lead to further exploitation vectors if those internal endpoints have their own vulnerabilities or trust relationships with other systems. The combination of credential theft and potential service disruption through unauthorized internal requests creates a significant risk profile for organizations relying on Unleash for critical feature management workflows.
To mitigate this vulnerability, immediate action is required by upgrading the Unleash platform to version 7.5.2, 7.6.5, or 8.0.2 where these restrictions have been implemented in the source code. For environments that cannot immediately upgrade, network-level controls such as egress filtering should be enforced on the server hosting Unleash to prevent outbound connections to private IP ranges and cloud metadata endpoints unless explicitly required for business logic. Input validation at the application layer must also ensure that only whitelisted domains or specific internal service addresses are permitted in webhook URLs. Monitoring logs for unusual outbound connection patterns can aid in detecting exploitation attempts before significant damage occurs, aligning with ATT&CK techniques related to server-side request forgery and credential access through network protocols.