Unleash up to 7.5.1/7.6.4/8.0.1 Addon src/lib/addons/addon.ts Addon.fetchRetry parameters.url permission

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Unleash up to 7.5.1/7.6.4/8.0.1. This affects the function Addon.fetchRetry of the file src/lib/addons/addon.ts of the component Addon. This manipulation of the argument parameters.url causes permission. This vulnerability is handled as CVE-2026-63004. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Unleash up to 7.5.1/7.6.4/8.0.1. It has been declared as problematic. Affected by this vulnerability is the function Addon.fetchRetry of the file src/lib/addons/addon.ts of the component Addon. The manipulation of the argument parameters.url with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-63004 since 07/15/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 7.5.2, 7.6.5 or 8.0.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Unleash

Version

• 7.5.0
• 7.5.1
• 7.6.0
• 7.6.1
• 7.6.2
• 7.6.3
• 7.6.4
• 8.0.0
• 8.0.1

Website

• Product: https://github.com/Unleash/unleash/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion