---
id: "CVE-2026-65967"
page: "https://infrastack.ai/live/CVE-2026-65967"
kind: "vulnerability"
aliases: ["CVE-2026-65967"]
title: "Fider: webhook URLs let admins make server fetch internal addresses"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fider", "other", "self-hosted"]
not_affected_if: ["version-0.34.0-or-later"]
published_at: "2026-11-11T19:17:44+00:00"
first_seen_at: "2026-11-11T19:28:48+00:00"
updated_at: "2026-11-11T19:30:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65967", "first_seen_at": "2026-11-11T19:28:48+00:00"}]
exploit_sources: []
---

# Fider: webhook URLs let admins make server fetch internal addresses

Link for people: https://infrastack.ai/live/CVE-2026-65967 (this .md is for agents)

Fider is a self-hosted feedback portal, and before version 0.34.0 its webhook URL handling did not block requests to internal or cloud metadata addresses. An attacker with admin rights can make the server send HTTP requests to internal services and read cloud metadata endpoints.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Fider version running on the server; versions before `0.34.0` are affected.
- Look in the admin settings for configured webhooks; unknown whether other settings expose the same path.

## Fix

- Fider: upgrade to `0.34.0` or later.

## Timeline

- 2026-11-11T19:28:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65967

## Documents

- [advisory] Vendor advisory: github.com https://github.com/getfider/fider/security/advisories/GHSA-g445-xwm7-594r
- [fix] Release notes: github.com https://github.com/getfider/fider/releases/tag/v0.34.0

## From the sources

Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_