CVE-2026-79671: Ech0 before 4.4.3 SSRF via DNS Resolution Bypass
Ech0 through 4.2.1 contains a server-side request forgery vulnerability in the validateWebhookURL function (webhooksettingservice.go), which only validates literal IP addresses via net.ParseIP() and fails to reject hostnames that DNS-resolve to private or internal IPs (e.g., 169.254.169.254.nip.io). An attacker with admin privileges can create a webhook with such a hostname to bypass validation and cause the server to make requests to internal services, cloud metadata endpoints, and private network resources. The issue is fixed in 4.4.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.4.3 - Compensating control
Restrict admin privileges so attackers cannot create webhooks (the SSRF is reachable via webhook creation and hostname validation bypass).
- Operational
Review and remove any attacker-created webhooks created prior to upgrading to 4.4.3 to prevent further SSRF attempts.
Event History
Frequently Asked Questions
Who can exploit this issue, and what access is required?
An attacker needs administrator privileges in Ech0 and must be able to create a webhook. They can supply a hostname that resolves to an internal or private IP address, bypassing validation that only checks literal IP addresses.
What systems or resources could be reached through a successful exploit?
The Ech0 server can be induced to make requests to internal services, private network resources, and cloud metadata endpoints. Exposure depends on what the server can reach over its network connections.
How can I tell whether my deployment is affected?
Deployments running Ech0 through version 4.2.1 are affected according to the advisory. Review webhook configurations for hostnames that resolve to private or internal addresses, including names such as 169.254.169.254.nip.io.
What should be done if updating is not immediately possible?
Restrict administrator access and review or remove webhook configurations that use hostnames resolving to private or internal IP ranges. Limit the Ech0 server's network access to internal services and metadata endpoints where possible.
What version fixes the issue?
The issue is fixed in Ech0 version 4.4.3.