CVE-2026-123204— Posta before v0.18.0 SSRF via Webhook URL

Quick assessment

Affected

goposta posta

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Posta 在 v0.18.0 之前的版本中存在服务端请求伪造（SSRF）漏洞。该漏洞允许拥有编辑权限的已认证用户通过创建包含任意 URL 的 Webhook，诱导后端向内部目标发送 POST 请求。攻击者可利用此漏洞针对回环地址、私有网络地址或云元数据地址发起请求，并通过读取投递状态码和错误信息来探测内部主机和端口。

CVSS 4.3 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1046 · Network Service Discovery T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
goposta	posta	`< v0.18.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Posta before v0.18.0 SSRF via Webhook URL

Source: CVE Program / CVE List V5

Vulnerability Description

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
goposta	posta	0 ~ v0.18.0	-

II. Public POCs for CVE-2026-123204

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123204

请登录查看更多情报信息。

Other References for CVE-2026-123204 (6)

https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a patch
https://github.com/goposta/posta/issues/282 issue-tracking
https://github.com/goposta/posta/pull/315 patch issue-tracking
https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/services/webhook/dispatcher.go#L321-L338 technical-description
https://github.com/goposta/posta/releases/tag/v0.18.0 release-notes
https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123204

IV. Related Vulnerabilities

Same weakness: CWE-918