CVE-2026-80350
Received Received - Intake

IPv4-mapped IPv6 SSRF Bypass in OneUptime

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: VulnCheck

Description
OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 ranges and tests an IPv6 value against the unspecified address, the loopback, the link-local prefix and the unique-local prefixes. A value such as [::ffff:127.0.0.1] matches none of them. The value is also recognised as an address literal rather than a name, so the path that re-checks addresses obtained from resolution is not taken. The HTTP client treats the mapped form as the embedded IPv4 address and connects to it, so an authenticated project member who can configure a webhook can direct the server at loopback services, private network ranges and link-local metadata endpoints, and the response is recorded where the webhook result can be read. Version 12.0.7 adds handling for the mapped range.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80350
EUVD
EUVD-2026-66389

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oneuptime webhook_target_check to 12.0.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in OneUptime's webhook URL validation. It allows an authenticated user to bypass SSRF protections by using IPv4-mapped IPv6 addresses (e.g., [::ffff:127.0.0.1]) in webhook configurations. The server then sends HTTP requests to internal addresses like loopback services or private networks, potentially exposing sensitive data or enabling unauthorized access.

Detection Guidance

To detect this vulnerability, inspect OneUptime logs for outbound HTTP requests to IPv4-mapped IPv6 addresses like [::ffff:127.0.0.1]. Check webhook configurations for such addresses. Use network monitoring tools to identify unexpected connections to loopback or private IP ranges from the OneUptime server.

Impact Analysis

An attacker with webhook configuration privileges could exploit this to send requests to internal services, cloud metadata endpoints, or private network hosts. This may lead to data exposure, unauthorized access to internal APIs, or interaction with sensitive services, potentially compromising system confidentiality and integrity.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Exposure of internal services or metadata endpoints may result in non-compliance with data protection and security standards, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade OneUptime to version 12.0.7 or later to patch the SSRF flaw. Review and restrict webhook configurations to prevent IPv4-mapped IPv6 addresses. Disable redirect-following in HTTP clients to mitigate TOCTOU risks. Monitor network traffic for unauthorized outbound requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80350. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart