Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80350— OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

Quick assessment

Affected
OneUptime OneUptime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OneUptime是OneUptime组织的一款可观测性平台。 OneUptime 12.0.7之前版本存在服务端请求伪造漏洞，该漏洞源于对IPv4映射的IPv6地址过滤不完善，可能导致已认证的项目成员通过配置webhook将服务器指向回环服务、私有网络范围和链路本地元数据端点，造成服务端请求伪造攻击。

CVSS 7.1 · High EPSS 0.40% · P33

Affected Version Matrix 1

VendorProduct Version RangeStatus
OneUptime OneUptime < 12.0.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80350

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL
Source: CVE Program / CVE List V5
Vulnerability Description
OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 ranges and tests an IPv6 value against the unspecified address, the loopback, the link-local prefix and the unique-local prefixes. A value such as [::ffff:127.0.0.1] matches none of them. The value is also recognised as an address literal rather than a name, so the path that re-checks addresses obtained from resolution is not taken. The HTTP client treats the mapped form as the embedded IPv4 address and connects to it, so an authenticated project member who can configure a webhook can direct the server at loopback services, private network ranges and link-local metadata endpoints, and the response is recorded where the webhook result can be read. Version 12.0.7 adds handling for the mapped range.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
OneUptime 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OneUptime是OneUptime组织的一款可观测性平台。 OneUptime 12.0.7之前版本存在服务端请求伪造漏洞，该漏洞源于对IPv4映射的IPv6地址过滤不完善，可能导致已认证的项目成员通过配置webhook将服务器指向回环服务、私有网络范围和链路本地元数据端点，造成服务端请求伪造攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
OneUptime OneUptime 0 ~ 12.0.7 -

II. Public POCs for CVE-2026-80350

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80350

请登录查看更多情报信息。

Other References for CVE-2026-80350 (5)

IV. Related Vulnerabilities

Same product: OneUptime
Same vendor: OneUptime
Same weakness: CWE-918

V. Comments for CVE-2026-80350

No comments yet

Leave a comment