CVE-2026-71271
Received Received - Intake

Memos Webhook URL Validation Bypass via 0.0.0.0

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() — unlike the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go, which does. Because Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1), an attacker registering a webhook URL of http://0.0.0.0:PORT/ bypasses the reserved-IP check and causes the Memos server to make outbound HTTP requests to its own loopback interface, exposing internal-only services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71271
EUVD
EUVD-2026-53356

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
usememos memos *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Memos' webhook URL validation function, isReservedIP(), which fails to properly check for the IP address 0.0.0.0/8. Unlike the correct implementation in isInternalIP(), it doesn't call ip.IsUnspecified(). Since Linux redirects 0.0.0.0 to loopback (127.0.0.1), an attacker can register a webhook URL using 0.0.0.0 to bypass IP restrictions and force the Memos server to send outbound requests to its own loopback interface, exposing internal services.

Detection Guidance

To detect this vulnerability, monitor outbound HTTP requests from your Memos server to localhost or reserved IP ranges. Check webhook configurations for URLs using 0.0.0.0 or similar bypasses. Inspect network logs for unexpected connections to 127.0.0.1 from Memos processes.

Impact Analysis

An attacker could exploit this to make the Memos server interact with internal services it shouldn't access, potentially leading to data leaks, unauthorized actions, or service disruption. The high CVSS score (8.5) indicates significant risk, especially since it allows lateral movement within a network.

Compliance Impact

This vulnerability could violate compliance requirements by exposing internal services or sensitive data to unauthorized access. GDPR may require breach notification if personal data is exposed, while HIPAA could be violated if protected health information is compromised due to unauthorized internal access.

Mitigation Strategies

Update Memos to the latest patched version where isReservedIP() includes 0.0.0.0/8 and calls ip.IsUnspecified(). Temporarily disable webhook functionality if an update is not immediately available. Monitor network logs for outbound requests to 0.0.0.0 or loopback addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart