---
id: "CVE-2026-114064"
kind: "vulnerability"
aliases: ["CVE-2026-114064"]
title: "Snipe-IT: webhook test feature lets super-admins probe internal network hosts"
severity: "medium"
cvss: 5.5
epss: 0.0027
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["asset-management", "other", "self-hosted", "snipe-it"]
not_affected_if: ["no-super-admin-exposure", "upgraded-to-8.7.0"]
published_at: "2026-10-21T01:17:29+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T04:11:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114064", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114064", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Snipe-IT: webhook test feature lets super-admins probe internal network hosts

Snipe-IT versions before 8.7.0 have a server-side request forgery flaw in the webhook test feature. A super-admin can point a webhook at loopback or private addresses and use the differing responses to map internal hosts and open ports.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Snipe-IT version in the admin panel or the application's `.env`/release tag; versions below `8.7.0` are in scope.
- Confirm whether the webhook test feature is used at all; the sources do not give a specific setting to disable it.

## Fix

- Upgrade Snipe-IT to `8.7.0` or later.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114064
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114064

## From the sources

Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_