OneUptime up to 12.0.6 Webhook Target Check SSRFProtection.ts SSRFProtection.validateWebhookTargetIsSafe server-side request forgery

Summaryinfo

A vulnerability marked as problematic has been reported in OneUptime up to 12.0.6. This affects the function SSRFProtection.validateWebhookTargetIsSafe of the file Common/Server/Utils/SSRFProtection.ts of the component Webhook Target Check. This manipulation causes server-side request forgery. The identification of this vulnerability is CVE-2026-80350. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic was found in OneUptime up to 12.0.6. Affected by this vulnerability is the function SSRFProtection.validateWebhookTargetIsSafe of the file Common/Server/Utils/SSRFProtection.ts of the component Webhook Target Check. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. The summary by CVE is:

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 ranges and tests an IPv6 value against the unspecified address, the loopback, the link-local prefix and the unique-local prefixes. A value such as [::ffff:127.0.0.1] matches none of them. The value is also recognised as an address literal rather than a name, so the path that re-checks addresses obtained from resolution is not taken. The HTTP client treats the mapped form as the embedded IPv4 address and connects to it, so an authenticated project member who can configure a webhook can direct the server at loopback services, private network ranges and link-local metadata endpoints, and the response is recorded where the webhook result can be read. Version 12.0.7 adds handling for the mapped range.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-80350 since 08/26/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 12.0.7 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-66389). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• OneUptime

Version

• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4
• 12.0.5
• 12.0.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion