CVE-2026-34590: Postiz: SSRF via Webhook Creation Endpoint Missing URL Safety Validation
Postiz is an AI social media scheduling tool. Prior to version 2.21.4, the POST /webhooks/ endpoint for creating webhooks uses WebhooksDto which validates the url field with only @IsUrl() (format check), missing the @IsSafeWebhookUrl validator that blocks internal/private network addresses. The update (PUT /webhooks/) and test (POST /webhooks/send) endpoints correctly apply @IsSafeWebhookUrl. When a post is published, the orchestrator fetches the stored webhook URL without runtime validation, enabling blind SSRF against internal services. This issue has been patched in version 2.21.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Postizto a version that resolves this vulnerability.Fixed in 2.21.4 - Compensating control
Restrict network egress from the Postiz orchestrator (where it fetches stored webhook URLs) so it cannot reach internal/private network addresses, mitigating blind SSRF during webhook fetching.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34590?
The severity of CVE-2026-34590 is classified as critical due to the potential for server-side request forgery (SSRF) attacks.
How do I fix CVE-2026-34590?
To fix CVE-2026-34590, upgrade Postiz to version 2.21.4 or later to include proper URL safety validation.
What is the main issue with CVE-2026-34590?
CVE-2026-34590 arises from the lack of proper URL safety validation in the webhook creation endpoint, allowing for potential SSRF exploits.
What versions of Postiz are affected by CVE-2026-34590?
Versions of Postiz prior to 2.21.4 are affected by CVE-2026-34590.
What is SSRF in the context of CVE-2026-34590?
In the context of CVE-2026-34590, SSRF refers to server-side request forgery, where an attacker could manipulate the server to make arbitrary requests.