CVE-2026-71271

Received Received - Intake

Memos Webhook URL Validation Bypass via 0.0.0.0

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-18

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-17

NVD

CVE-2026-71271

EUVD

EUVD-2026-53356

Affected Vendors & Products

Vendor	Product	Version / Range
usememos	memos	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves Memos' webhook URL validation function, isReservedIP(), which fails to properly check for the IP address 0.0.0.0/8. Unlike the correct implementation in isInternalIP(), it doesn't call ip.IsUnspecified(). Since Linux redirects 0.0.0.0 to loopback (127.0.0.1), an attacker can register a webhook URL using 0.0.0.0 to bypass IP restrictions and force the Memos server to send outbound requests to its own loopback interface, exposing internal services.

Detection Guidance

To detect this vulnerability, monitor outbound HTTP requests from your Memos server to localhost or reserved IP ranges. Check webhook configurations for URLs using 0.0.0.0 or similar bypasses. Inspect network logs for unexpected connections to 127.0.0.1 from Memos processes.

Impact Analysis

An attacker could exploit this to make the Memos server interact with internal services it shouldn't access, potentially leading to data leaks, unauthorized actions, or service disruption. The high CVSS score (8.5) indicates significant risk, especially since it allows lateral movement within a network.

Compliance Impact

This vulnerability could violate compliance requirements by exposing internal services or sensitive data to unauthorized access. GDPR may require breach notification if personal data is exposed, while HIPAA could be violated if protected health information is compromised due to unauthorized internal access.

Mitigation Strategies

Update Memos to the latest patched version where isReservedIP() includes 0.0.0.0/8 and calls ip.IsUnspecified(). Temporarily disable webhook functionality if an update is not immediately available. Monitor network logs for outbound requests to 0.0.0.0 or loopback addresses.

Hi! I’m here to help you understand CVE-2026-71271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70