CVE-2026-55591: Unauthenticated SSRF in Signal Server 2.27.0 - Analysis & PoC

Vulnerability Summary: Server-Side Request Forgery via Remote Connection Endpoints Vulnerability Overview Vulnerability Name: Server-Side Request Forgery (SSRF) via Remote Connection Endpoints CVE ID: CVE-2026-55591 CWE: CWE-918 Severity: Critical (CVSS 3.1 Score 8.1/10) Affected Versions: <= 2.27.0 Fixed Version: 2.28.0 Vulnerable Function: (located at ) Core Issue: accepts attacker-controlled parameters such as , , , , and without performing any validation on the target host. This allows the server to initiate arbitrary HTTP/HTTPS requests to any internal network resources, cloud metadata services, or other unexpected targets. Under default configuration (when is not configured), these endpoints are accessible without authentication. Scope of Impact Reachable Addresses: - Loopback: , , - RFC 1918 Private Network Ranges: , , - Link-local / Cloud Metadata: (AWS EC2 instance metadata, GCP, Azure IMDS) - IPv4 Link-local: - Any external host (the server can be leveraged as an open proxy) Authentication Bypass: Under default configurations, acts as a no-op, allowing access to three endpoints without authentication. TLS Validation Bypass: The parameter directly controls . If an attacker sets , the server can connect to arbitrary HTTPS endpoints without validating certificates, creating a risk of man-in-the-middle attacks. Path Traversal: The endpoint directly concatenates into the URL path. Attackers can use path traversal sequences like to target any path on the host. Remediation Upgrade to 2.28.0 or later. Configure policies (e.g., ) to avoid the authentication bypass caused by the default no-op behavior. Implement whitelist/blacklist validation for the target host in , prohibiting loopback, private network ranges, link-local, and cloud metadata addresses. Enable TLS certificate validation by default ( ). Apply path normalization to in to prevent path traversal. POC Code Target Environment Setup Set target variable: PoC 1: Loopback Connection (Self-Discovery) Response (confirming the server connects to itself): PoC 2: Port Scanning (Based on Error Discrepancies) The three distinct error responses allow attackers to map the internal network topology. PoC 3: AWS Instance Metadata Service (IMDSv1) On a cloud-hosted signal-server (AWS EC2): The server connects to the EC2 metadata endpoint. The response will include a JSON parsing failure, leaking the metadata. For deeper paths, use with path traversal: Impact 1. Internal Network Scanning: Attackers can probe internal hosts and ports. Responses can distinguish between open ports (HTTP response returned), closed ports (connection refused), and filtered ports (10-second timeout). 2. Cloud Metadata Leakage: On cloud-hosted instances (AWS EC2, GCP, Azure), attackers can read the instance metadata service at to steal sensitive data such as IAM credentials and instance identity tokens. 3. Internal Service Data Exfiltration: The endpoint returns the full response body from the target, allowing attackers to read data from internal HTTP services that are otherwise inaccessible from outside. 4. Server-Side POST Requests: The endpoint sends POST requests with an attacker-controlled JSON body, enabling interaction with internal APIs that accept POST requests. 5. Potential for Further Exploitation: In containerized or Kubernetes environments, the server can be leveraged to access in-cluster services, the Kubernetes API, or other containers within the Docker network.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-55591: Unauthenticated SSRF in Signal Server 2.27.0 - Analysis & PoC

More from this source