← CVE Radar
CVE-2026-123204Posta before v0.18.0 SSRF via Webhook URL
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
5.3 MEDIUMEPSS 0.30%Not in KEVNVD: Received
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 5.3 | MEDIUM | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N |
| 4.3 | MEDIUM | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Details
- CVE ID
- CVE-2026-123204
- Status
- Received
- Assigner (CNA)
- VulnCheck
- Published
- Nov 5, 2026
- Last modified
- 2026-11-05 19:17 UTC
- Weaknesses
- CWE-918 · Server-Side Request Forgery (SSRF)
Affected Products
As published by the CNA in the CVE record.
gopostaposta1 version range
- before v0.18.0
References
- github.com https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/services/webhook/dispatcher.go#L321-L338
- github.com https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a
- github.com https://github.com/goposta/posta/issues/282
- github.com https://github.com/goposta/posta/pull/315
- github.com https://github.com/goposta/posta/releases/tag/v0.18.0
- vulncheck.com https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url