Server-Side Request Forgery in Logto

Executive Summary

CVE-2026-82262 is a Server-Side Request Forgery (SSRF) vulnerability in Logto versions up to 1.42.0. It exists in the POST /api/hooks/:id/test endpoint, which fails to validate host inputs. Tenant administrators with Management API tokens can send arbitrary HTTP POST requests to internal or private network services and retrieve their response bodies.

Useful 0 Not Useful 0

Detection Guidance

To detect exploitation of CVE-2026-82262, monitor outbound HTTP POST requests from your Logto server, especially to internal or private IP addresses. Check Logto server logs for POST /api/hooks/:id/test endpoint requests with arbitrary URLs. Use network traffic analysis tools like tcpdump or Wireshark to inspect requests to loopback addresses (127.0.0.1), RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or cloud metadata endpoints (169.254.169.254).

Commands: tcpdump -i any 'host 127.0.0.1 and tcp port 80' to capture local requests. Check Logto logs for POST /api/hooks/:id/test with external URLs. Use curl to test the endpoint: curl -X POST http://your-logto-server/api/hooks/1/test -H 'Authorization: Bearer <token>' -H 'Content-Type: application/json' -d '{"url":"http://169.254.169.254/latest/meta-data/"}'

Enable SSRF protection in Logto by setting SSRF_PROTECTION_DISABLED=false (default) and review blocked requests in logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to access internal network resources, retrieve sensitive data from private services, or interact with cloud metadata endpoints. This could lead to unauthorized access to deployment network information or other internal systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information. It may result in data breaches, unauthorized disclosures, and non-compliance with regulatory standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Logto to a version that includes the SSRF fix (commit 16f4b2e732d5114ac98646c9370ec6ab61d6ed26 or later). Disable the vulnerable POST /api/hooks/:id/test endpoint if not needed. Rotate all Management API tokens to prevent unauthorized access.

Apply SSRF protection by setting SSRF_PROTECTION_DISABLED=false (enabled by default in self-hosted deployments). Use SSRF_ALLOWED_ADDRESSES to whitelist trusted endpoints if necessary. Monitor logs for blocked SSRF attempts.

Restrict network access to Logto server to prevent external exploitation. Review all webhook configurations and SSO connectors for suspicious URLs.

Useful 0 Not Useful 0