Live › vulnerability › CVE-2026-114064
Go to dashboardSnipe-IT versions before 8.7.0 have a server-side request forgery flaw in the webhook test feature. A super-admin can point a webhook at loopback or private addresses and use the differing responses to map internal hosts and open ports.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or managed Snipe-IT instances before 8.7.0 where super-admin accounts exist. The attacker needs super-admin access, so instances with tightly held super-admin accounts face lower practical risk. Teams on 8.7.0 or later are not affected.
No product ranges from the sources yet.
.env/release tag; versions below 8.7.0 are in scope.8.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.
This page as .md · .json · in your agent: get_signal("CVE-2026-114064")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.