---
id: "CVE-2026-123204"
kind: "vulnerability"
aliases: ["CVE-2026-123204"]
title: "Posta: webhook URLs let authenticated editors probe internal hosts"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "posta", "self-hosted", "webhooks"]
not_affected_if: ["managed-hosting", "version-0.18.0-or-later"]
published_at: "2026-11-05T19:17:19+00:00"
first_seen_at: "2026-11-05T19:40:36+00:00"
updated_at: "2026-11-05T19:43:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123204", "first_seen_at": "2026-11-05T19:40:36+00:00"}]
exploit_sources: []
---

# Posta: webhook URLs let authenticated editors probe internal hosts

Posta before v0.18.0 lets a logged-in user with edit rights create webhooks pointing at arbitrary URLs, and the server sends POST requests to them. An attacker can aim these at loopback, private-network or cloud metadata addresses and read status codes and error strings to map internal hosts and ports.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Posta version in use, for example with `posta --version` or the image tag, and check whether it is below `0.18.0`
- Review which accounts hold edit rights in Posta and whether webhook creation is open to them

## Fix

- Posta: upgrade to `0.18.0` or later

## Timeline

- 2026-11-05T19:40:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123204

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url
- [fix] Patch: github.com https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a
- [fix] Release notes: github.com https://github.com/goposta/posta/releases/tag/v0.18.0

## From the sources

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_