CVE-2026-63004
Received Received - Intake

Server-Side Request Forgery in Unleash Feature Management

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-63004
EUVD
EUVD-2026-64040

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
unleash unleash to 8.0.0 (exc)
unleash unleash 7.5.2
unleash unleash 7.6.5
unleash unleash 8.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63004 is a Server-Side Request Forgery (SSRF) vulnerability in the Unleash open-source feature flag management system affecting versions 8.0.0 and earlier. It allows authenticated users with specific permissions to configure webhook URLs without proper host validation, enabling requests to internal services, cloud metadata endpoints, or localhost. The vulnerability can be exploited to send sensitive data like Authorization tokens or custom headers to attacker-controlled hosts.

Detection Guidance

Monitor network traffic for outbound requests to internal or private IP addresses from the Unleash server. Check integration logs for unusual webhook URLs or failed requests to cloud metadata endpoints like 169.254.169.254. Review Unleash server logs for requests to localhost or private network ranges.

Impact Analysis

An attacker with root permissions (CREATE_ADDON or UPDATE_ADDON) can cause the Unleash server to send requests to internal services, exfiltrate sensitive headers like Authorization tokens or DD-API-KEY, and probe internal services using integration event status as a timing oracle. The feature-event JSON body may also be delivered to internal endpoints.

Mitigation Strategies

Upgrade Unleash to versions 7.5.2, 7.6.5, or 8.0.2 or later. Disable the affected integrations if not required. Configure environment variables UNLEASH_ALLOW_PRIVATE_URL_IN_INTEGRATION=false and UNLEASH_ALLOW_LIST_INTEGRATION to restrict URLs. Review and restrict CREATE_ADDON and UPDATE_ADDON permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63004. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart