CVE-2026-34590: Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation

Published Apr 2, 2026
·
Updated

Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.

Affected Software

1 affected component
Gitroom Postiz<2.21.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Postiz to a version that resolves this vulnerability.

    Fixed in 2.21.4
  2. Compensating control

    Restrict network egress from the Postiz orchestrator (where it fetches stored webhook URLs) so it cannot reach internal/private network addresses, mitigating blind SSRF during webhook fetching.

Event History

Apr 2, 2026
CVE Published
via MITRE·05:26 PM
Data Sourced
via MITRE·05:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-34590?

The severity of CVE-2026-34590 is classified as critical due to the potential for server-side request forgery (SSRF) attacks.

2

How do I fix CVE-2026-34590?

To fix CVE-2026-34590, upgrade Postiz to version 2.21.4 or later to include proper URL safety validation.

3

What is the main issue with CVE-2026-34590?

CVE-2026-34590 arises from the lack of proper URL safety validation in the webhook creation endpoint, allowing for potential SSRF exploits.

4

What versions of Postiz are affected by CVE-2026-34590?

Versions of Postiz prior to 2.21.4 are affected by CVE-2026-34590.

5

What is SSRF in the context of CVE-2026-34590?

In the context of CVE-2026-34590, SSRF refers to server-side request forgery, where an attacker could manipulate the server to make arbitrary requests.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203