CVE-2026-41687
Blind SSRF in Wallos Subscription Tracker
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ellite | wallos | 4.8.1 |
| ellite | wallos | to 4.8.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-41687 vulnerability allows authenticated users to perform Blind SSRF attacks against internal services, potentially enabling unauthorized access or manipulation of internal systems. This could pose risks to data integrity and security.
Such unauthorized access risks may impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and ensure data integrity and confidentiality.
However, the provided information does not explicitly state the direct impact on compliance with these standards.
Can you explain this vulnerability to me?
CVE-2026-41687 is a Server-Side Request Forgery (SSRF) vulnerability in Wallos, an open-source personal subscription tracker. The vulnerability exists because the SSRF protection in certain endpoints (subscription and payment logo URL fetching) uses an inline IP validation that fails to block Carrier-Grade NAT (CGNAT) IP ranges (100.64.0.0/10). Although the application has a dedicated function to detect CGNAT IPs, this function is not used in these endpoints, allowing authenticated users to perform Blind SSRF attacks targeting internal services within CGNAT environments such as Tailscale or corporate networks.
How can this vulnerability impact me? :
This vulnerability can allow authenticated users to perform Blind SSRF attacks, which may enable them to scan ports or discover services within internal networks that use CGNAT addressing. This could lead to unauthorized access or manipulation of internal systems, potentially compromising data integrity and security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Server-Side Request Forgery (SSRF) allowing authenticated users to make requests to internal CGNAT IP ranges (100.64.0.0/10). Detection can focus on monitoring outgoing requests from the Wallos application to these internal IP ranges, especially from the subscription and payment logo URL fetching endpoints.
You can detect potential exploitation by inspecting logs for unusual outbound HTTP requests to the 100.64.0.0/10 IP range or other internal services that should not be accessed externally.
- Use network monitoring tools (e.g., tcpdump or Wireshark) to capture outbound traffic from the Wallos server and filter for connections to 100.64.0.0/10 addresses.
- Example tcpdump command to capture such traffic: sudo tcpdump -i <interface> net 100.64.0.0/10
- Check application logs for HTTP requests or errors related to subscription or payment endpoints that include URLs pointing to internal CGNAT IPs.
- If possible, enable verbose logging or debugging in Wallos to trace URL fetching activities related to subscription and payment logo URLs.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation is to upgrade Wallos to version 4.8.1 or later, where this SSRF vulnerability has been patched.
If upgrading immediately is not possible, consider restricting access to the vulnerable endpoints to trusted users only, as the vulnerability requires authentication.
Additionally, network-level controls can be applied to block outbound requests from the Wallos server to the CGNAT IP range (100.64.0.0/10) to prevent SSRF exploitation.
Review and apply the patch or code changes from commit e79f28b which improves SSRF protection by using enhanced URL validation and restricting connections to pre-validated IP addresses.