Live › vulnerability › CVE-2026-118172
Go to dashboardStrapi's webhook dispatcher follows HTTP redirects without rechecking whether the destination is a private or link-local address. An attacker who can trigger webhooks can make the server send requests to internal hosts and see error responses reflected back.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Teams running a self-hosted Strapi instance with webhooks enabled are exposed, because the server itself makes the outbound requests. Instances that do not use webhooks, or that sit behind network egress rules blocking internal ranges, have less exposure. The sources do not say which Strapi versions are affected.
No product ranges from the sources yet.
@strapi/strapi package with npm ls @strapi/strapi@strapi/strapi; check the Strapi release notes or the advisory on NVDEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
This page as .md · .json · in your agent: get_signal("CVE-2026-118172")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.