CVE-2026-76239: Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address
Stigmem before 0.9.0a11 fails to validate the deliveryaddress parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Stigmemto a version that resolves this vulnerability.Fixed in 0.9.0a11
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can create webhook subscriptions can exploit it. They must be able to supply the webhook delivery_address and trigger a matching fact-change event.
What systems are exposed to the server-side requests?
The Stigmem server can be induced to send HTTP POST requests to loopback addresses and private-network endpoints reachable from that server. The described impact is blind SSRF, so the attacker can trigger requests without necessarily receiving the target's response.
Are installations running version 0.9.0a11 affected?
The issue is described as affecting Stigmem versions before 0.9.0a11. The provided information does not identify any other affected configuration conditions.