Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77067— Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation

Quick assessment

Affected
omnivore-app omnivore
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中的 在存储由调用者提供的 URL 时，未进行任何地址验证，且该文件未导入任何验证辅助函数。当订阅的事件触发时， 中的 函数会使用该 URL、webhook 中记录的方法和内容类型（Content-Type），以及包含事件数据的 JSON 请求体发起 axios 请求。因此，经过身份验证的用户可以使服务器向内部端点（包括链接本地元数据地址）发送反复的、由攻击者构造的请求。该请求是“盲发”的： 会丢弃响应结果，仅将成功日志或 axios 错误写入服务器日志，因此响应不会通过 API 返回。

CVSS 5.0 · Medium EPSS 0.22% · P13

Affected Version Matrix 1

VendorProduct Version RangeStatus
omnivore-app omnivore < c4d7d8562e6b9aabb1d8e4dabca268e314baa43a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77067

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation
Source: CVE Program / CVE List V5
Vulnerability Description
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
omnivore-app omnivore 0 ~ c4d7d8562e6b9aabb1d8e4dabca268e314baa43a -

II. Public POCs for CVE-2026-77067

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77067

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77067 (2)

Proof of Concept for CVE-2026-77067 (1)

Other References for CVE-2026-77067 (2)

IV. Related Vulnerabilities

Same product: omnivore
Same vendor: omnivore-app
Same weakness: CWE-918

V. Comments for CVE-2026-77067

No comments yet

Leave a comment