CVE-2026-127093: Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routingoverride.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.26.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account or access path with permission to update integrations. They can then invoke the integration test endpoint and provide a malicious routing_override.url value.
What internal resources can be targeted?
The issue can be used to send server-side requests to arbitrary destinations, including loopback addresses, private-network services, and cloud metadata addresses. Custom request headers can be supplied, and redirects are followed.
Can an attacker obtain data through the vulnerable endpoint?
Yes. Non-2xx response bodies from the targeted destination are returned in the API response, which can expose data reachable by the Rustrak server.
Which versions require remediation?
Rustrak versions before 0.26.0 are affected. Upgrade to version 0.26.0 or later.