CVE-2026-79671
Received Received - Intake

Server-Side Request Forgery in Ech0 Webhook Validation

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Ech0 through 4.2.1 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhook_setting_service.go), which only validates literal IP addresses via net.ParseIP() and fails to reject hostnames that DNS-resolve to private or internal IPs (e.g., 169.254.169.254.nip.io). An attacker with admin privileges can create a webhook with such a hostname to bypass validation and cause the server to make requests to internal services, cloud metadata endpoints, and private network resources. The issue is fixed in 4.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79671
EUVD
EUVD-2026-65443

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ech0 ech0 4.4.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79671 is a Server-Side Request Forgery (SSRF) vulnerability in Ech0 versions before 4.4.3. The validateWebhookURL function only checks literal IP addresses but fails to block hostnames that DNS-resolve to private or internal IPs, such as 169.254.169.254.nip.io. An attacker with admin privileges can exploit this to bypass validation and force the server to send requests to internal services or cloud metadata endpoints.

Detection Guidance

Check Ech0 versions prior to 4.4.3 for the SSRF vulnerability. Inspect webhook configurations for hostnames resolving to private IPs like 169.254.169.254.nip.io. Review server logs for unexpected outbound requests to internal or cloud metadata endpoints.

Impact Analysis

An attacker could exploit this to access cloud metadata endpoints (e.g., AWS 169.254.169.254) to steal IAM credentials or probe internal network services. The server may send requests to private network resources, potentially exposing sensitive data or enabling further attacks.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services or cloud metadata endpoints, potentially exposing sensitive data such as IAM credentials. This may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Upgrade Ech0 to version 4.4.3 or later. Implement DNS resolution validation in validateWebhookURL to block hostnames resolving to private IPs. Use a custom net.Dialer to enforce IP checks before connections. Monitor webhook activity for suspicious requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79671. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart