Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80350— OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL

Quick assessment

Affected
OneUptime OneUptime
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OneUptime 的 Webhook 目标校验机制能够拒绝以 IPv4 形式提供的私有地址和回环地址，以及少量特定形式的 IPv6 地址，但并未处理 IPv4 映射的 IPv6 地址范围。在 Webhook 交付流程中，系统调用了 SSRFProtection.validateWebhookTargetIsSafe 方法。其中，Common/Server/Utils/SSRFProtection.ts 文件内通过 isBlockedHostnameLiteral 函数执行主机字面量筛查，该筛查机制会拒绝私有和回环

CVSS 7.1 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
OneUptime OneUptime < 12.0.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80350

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OneUptime before 12.0.7 Server-Side Request Forgery via IPv4-Mapped IPv6 Webhook URL
Source: CVE Program / CVE List V5
Vulnerability Description
OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 ranges and tests an IPv6 value against the unspecified address, the loopback, the link-local prefix and the unique-local prefixes. A value such as [::ffff:127.0.0.1] matches none of them. The value is also recognised as an address literal rather than a name, so the path that re-checks addresses obtained from resolution is not taken. The HTTP client treats the mapped form as the embedded IPv4 address and connects to it, so an authenticated project member who can configure a webhook can direct the server at loopback services, private network ranges and link-local metadata endpoints, and the response is recorded where the webhook result can be read. Version 12.0.7 adds handling for the mapped range.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
OneUptime OneUptime 0 ~ 12.0.7 -

II. Public POCs for CVE-2026-80350

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80350

请登录查看更多情报信息。

Other References for CVE-2026-80350 (5)

IV. Related Vulnerabilities

Same product: OneUptime
Same vendor: OneUptime
Same weakness: CWE-918

V. Comments for CVE-2026-80350

No comments yet

Leave a comment