CVE-2026-118172: SSRF
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need in order to exploit this issue?
The attacker needs a way to cause the webhook dispatcher to request an attacker-controlled URL that returns a redirect. The redirect can then point the dispatcher at internal, RFC1918, or link-local addresses because the destination is not revalidated after the redirect.
What information can be exposed through the SSRF?
Responses from target endpoints that return non-2xx status codes are captured and reflected to the caller. This makes the issue semi-blind: an attacker may obtain response content or error details from reachable internal services when they produce non-2xx responses.
Are internal network addresses protected after a redirect?
No. The webhook dispatcher follows HTTP redirects without post-redirect IP resolution or checks for RFC1918 or link-local address ranges. A redirect can therefore move a request from an initially permitted destination to an internal address.
What version contains the referenced fix information?
The provided reference points to the Strapi v5.51.0 release.