CVE-2026-71271: Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
Published Aug 5, 2026
·Updated
Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does.
Affected Software
1 affected component
memos
Event History
Aug 5, 2026
CVE Published
via MITRE·12:26 PM
Data Sourced
via MITRE·12:26 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:24 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-71271?
CVE-2026-71271 has a severity rating of 8.5, categorized as high.
2
What type of vulnerability is CVE-2026-71271?
CVE-2026-71271 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
3
How do I fix CVE-2026-71271?
To fix CVE-2026-71271, ensure proper validation of webhook URLs against reserved IPs, especially including checks for 0.0.0.0.
4
What software is affected by CVE-2026-71271?
The vulnerability affects the Memos application.
5
When was CVE-2026-71271 published?
CVE-2026-71271 was published on August 5, 2026.