CVE-2026-41688: Incomplete fix for CVE-2026-33399: SSRF in Wallos
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPTRESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41688?
CVE-2026-41688 has a severity rating that indicates a significant risk due to its SSRF vulnerability.
How do I fix CVE-2026-41688?
To fix CVE-2026-41688, upgrade to a version of Wallos later than 4.8.4 where the SSRF issue has been properly addressed.
What does CVE-2026-41688 affect?
CVE-2026-41688 affects Wallos versions 4.8.4 and prior, which are susceptible to an incomplete SSRF fix.
What type of vulnerability is CVE-2026-41688?
CVE-2026-41688 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Are there any potential exploits for CVE-2026-41688?
Yes, attackers could potentially exploit CVE-2026-41688 to make unauthorized requests via the vulnerable Wallos application.