{"id":"CVE-2026-118172","kind":"vulnerability","aliases":["CVE-2026-118172"],"related":[],"title":"Strapi: webhook redirects let attackers reach internal network addresses","description":"The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.","summary":"Strapi's webhook dispatcher follows HTTP redirects without rechecking whether the destination is a private or link-local address. An attacker who can trigger webhooks can make the server send requests to internal hosts and see error responses reflected back.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["node","package","self-hosted","strapi"],"not_affected_if":["managed-hosting","no-webhooks-configured"],"how_to_check":"- Check the installed version of the `@strapi/strapi` package with `npm ls @strapi/strapi`\n- Confirm whether webhooks are configured in the admin panel under Settings, then Webhooks\n- unknown whether a specific version range is affected, as the sources do not say","fix":"- unknown: the sources do not name a patched version of `@strapi/strapi`; check the Strapi release notes or the advisory on NVD\n- Until a fix is applied, restrict outbound network access from the Strapi server to internal ranges (RFC1918 and link-local)","status":"open","published_at":"2026-10-27T19:17:28+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","triaged_at":"2026-10-27T19:35:14+00:00","updated_at":"2026-10-27T19:35:14+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-27T19:35:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched version of `@strapi/strapi`; check the Strapi release notes or the advisory on NVD\n- Until a fix is applied, restrict outbound network access from the Strapi server to internal ranges (RFC1918 and link-local)","reach":"network","title":"Strapi: webhook redirects let attackers reach internal network addresses","impact":"medium","summary":"Strapi's webhook dispatcher follows HTTP redirects without rechecking whether the destination is a private or link-local address. An attacker who can trigger webhooks can make the server send requests to internal hosts and see error responses reflected back.","category":"package","nicknames":[],"who_cares":["strapi","self-hosted","node"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reaches internal services and reads error responses from them","analyst_note":"Find the affected and fixed Strapi version ranges and whether admin credentials are needed to create webhooks, starting from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118172.","how_to_check":"- Check the installed version of the `@strapi/strapi` package with `npm ls @strapi/strapi`\n- Confirm whether webhooks are configured in the admin panel under Settings, then Webhooks\n- unknown whether a specific version range is affected, as the sources do not say","needs_analyst":true,"not_affected_if":["no-webhooks-configured","managed-hosting"],"who_is_affected":"Teams running a self-hosted Strapi instance with webhooks enabled are exposed, because the server itself makes the outbound requests. Instances that do not use webhooks, or that sit behind network egress rules blocking internal ranges, have less exposure. The sources do not say which Strapi versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":3356,"output_tokens":661,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118172':12A,15A '-2026':11A,14A '2xx':104C 'address':9A,41B 'admin':66C 'attack':5A,43B 'automat':87C 'back':62B,114C 'blind':76C 'boundari':100C 'caller':117C 'captur':110C 'check':101C 'core':65C 'cve':10A,13A 'destin':33B 'direct':113C 'dispatch':25B,86C 'endpoint':108C 'error':59B 'follow':26B,82C,88C 'follow-redirect':81C 'host':20B,56B 'http':27B,89C 'intern':7A,55B 'ip':96C 'let':4A 'link':39B 'link-loc':38B 'local':40B 'make':49B 'network':8A 'node':16B 'non':103C 'non-2xx':102C 'packag':17B,69C 'perform':92C 'post':94C 'post-redirect':93C 'privat':36B 'reach':6A 'recheck':30B 'redirect':3A,28B,83C,90C,95C 'reflect':61B,112C 'request':53B 'resolut':97C 'respons':60B,105C 'rfc1918/link-local':99C 'runner':68C 'see':58B 'self':19B 'self-host':18B 'semi':75C 'semi-blind':74C 'send':52B 'server':51B 'ssrf':77C 'strapi':1A,21B,22B 'strapi/strapi':64C 'target':107C 'trigger':46B 'via':78C 'vulner':71C 'webhook':2A,24B,47B,67C,80C,85C 'whether':31B 'without':29B,91C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted Strapi instance with webhooks enabled are exposed, because the server itself makes the outbound requests. Instances that do not use webhooks, or that sit behind network egress rules blocking internal ranges, have less exposure. The sources do not say which Strapi versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118172","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118172","severity":null,"published_at":"2026-10-27T19:17:28+00:00","modified_at":"2026-10-27T19:17:28+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}