CVE-2026-71271: Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() — unlike the correctly implemented sibling function isInternalIP() in internal/httpgetter/htmlmeta.go, which does. Because Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1), an attacker registering a webhook URL of http://0.0.0.0:PORT/ bypasses the reserved-IP check and causes the Memos server to make outbound HTTP requests to its own loopback interface, exposing internal-only services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71271?
CVE-2026-71271 has a severity rating of 8.5, categorized as high.
What type of vulnerability is CVE-2026-71271?
CVE-2026-71271 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
How do I fix CVE-2026-71271?
To fix CVE-2026-71271, ensure proper validation of webhook URLs against reserved IPs, especially including checks for 0.0.0.0.
What software is affected by CVE-2026-71271?
The vulnerability affects the Memos application.
When was CVE-2026-71271 published?
CVE-2026-71271 was published on August 5, 2026.