CVE-2026-116680: Homebox generic notifier SSRF via HTTP redirect after URL validation
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled delivery, but shoutrrr sends the request through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination, causing the follow-up request to bypass the product's SSRF policy. The flaw is reachable through POST /api/v1/notifiers/test for immediate requests and through stored notifiers during scheduled maintenance delivery. This issue is fixed in version 0.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HomeBoxto a version that resolves this vulnerability.Fixed in 0.27.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated HomeBox collection member can exploit it by configuring a generic notifier URL on an allowed host that redirects to a destination blocked by HomeBox's SSRF policy.
Which request paths are affected?
The issue is reachable through POST /api/v1/notifiers/test for immediate delivery. It can also be triggered later through stored notifier configurations during scheduled maintenance delivery.
What destinations could the redirect reach?
A permitted notifier host can redirect the follow-up request to loopback, link-local, cloud metadata, or another destination that HomeBox would otherwise block.
What should be done to remediate the issue?
Upgrade HomeBox to version 0.27.0, which fixes the redirect validation bypass.
How can I identify potentially affected configurations before upgrading?
Review generic notifier configurations, particularly URLs pointing to permitted external hosts that may issue HTTP redirects. Stored notifiers are relevant because scheduled delivery can trigger the redirected request even without using the test endpoint.