CVE-2026-77067: Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/callwebhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the vulnerable behavior?
An authenticated user with access to the setWebhook mutation can supply the webhook URL. Exploitation occurs when an event to which that webhook is subscribed fires.
Can an attacker read responses from internal services through this issue?
The request is blind: the webhook job discards the response and does not return it through the API. It logs only a success message or an Axios error on the server.
What network targets can the server be induced to contact?
Because the supplied URL is stored without address validation and later requested by the server, internal endpoints can be targeted, including link-local metadata addresses.
What evidence may indicate attempted exploitation?
Review configured webhook URLs and server logs produced by the webhook job. The job records either a success line or an Axios error for its outbound request.