CVE-2026-77067
Received Received - Intake

Stored SSRF in API Webhook Resolver via Unvalidated URL

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-77067
EUVD
EUVD-2026-63256

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
omnivore omnivore to c4d7d8562e6b9aabb1d8e4dabca268e314baa43a (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77067 is a stored Server-Side Request Forgery (SSRF) vulnerability in the Omnivore application. It occurs because the setWebhookResolver function stores user-supplied URLs without validation. When an event triggers, the callWebhook function sends HTTP requests to these URLs using axios, including internal endpoints and link-local metadata addresses. The attack is blind as responses are discarded and only logged.

Detection Guidance

Detecting this SSRF vulnerability requires monitoring outbound requests from your server to internal or unexpected endpoints. Check server logs for repeated requests to link-local metadata addresses (e.g., 169.254.169.254) or internal IP ranges. Use network monitoring tools like tcpdump or Wireshark to capture outbound traffic from the server running Omnivore. Look for HTTP requests originating from the application to unauthorized destinations.

Impact Analysis

An authenticated user can exploit this to force the server to send repeated requests to internal systems, potentially accessing sensitive data or services. The blind nature means the attacker cannot see responses but can still cause server-side actions or resource exhaustion.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized data exfiltration through SSRF attacks. An attacker could force the server to send requests to internal endpoints, potentially accessing or leaking sensitive user data stored in the application. This undermines data protection requirements under GDPR (e.g., Article 32 on security of processing) and HIPAA (e.g., safeguards for protected health information).

Mitigation Strategies

Immediately update Omnivore to a version that includes the fix (commit c4d7d8562e6b9aabb1d8e4dabca268e314baa43a or later). If updating is not possible, disable the webhook functionality or restrict outbound requests to trusted domains. Implement strict URL validation in the setWebhookResolver function to reject internal or invalid addresses. Monitor server logs for suspicious outbound requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77067. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart