CVE-2026-102877

Received Received - Intake

Server-Side Request Forgery in Fider Before 0.38.0

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: VulnCheck

Description

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-09-29

Generated

2026-09-30

AI Q&A

2026-09-30

EPSS Evaluated

N/A

NVD

CVE-2026-102877

EUVD

EUVD-2026-89412

Affected Vendors & Products

Vendor	Product	Version / Range
getfider	fider	to 0.38.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-102877 is a Server-Side Request Forgery (SSRF) vulnerability in Fider versions before 0.38.0. It occurs due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Attackers controlling DNS can exploit DNS rebinding to bypass SSRF protections, forcing the Fider server to send requests to internal services or cloud metadata endpoints.

Detection Guidance

Detecting this SSRF vulnerability requires checking if your Fider instance is running a vulnerable version (<= 0.37.0). Use commands like 'curl -s https://your-fider-domain.com/version' or check the admin panel for version info. If running a self-hosted instance, inspect the Docker image tag or Git commit hash. Vulnerable versions lack real-time IP validation during HTTP requests.

Impact Analysis

An attacker could exploit this to make the Fider server send outbound HTTP requests to internal network addresses, potentially accessing sensitive cloud metadata services or other internal services. This could lead to unauthorized access to internal resources or data exfiltration.

Mitigation Strategies

Upgrade Fider to version 0.38.0 or later immediately. This version enforces SSRF protection by validating destination IPs at connection time, blocking DNS rebinding attacks. For self-hosted instances, pull the latest Docker image or update via Git. Disable webhooks or OAuth providers temporarily if immediate upgrade isn't possible.

Hi! I’m here to help you understand CVE-2026-102877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70