Bug 2567435 (CVE-2026-123204)
| Summary: | CVE-2026-123204 github.com/goposta/posta: Posta: Server-side request forgery via arbitrary webhook URLs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Posta. An authenticated remote attacker with editing privileges can exploit a Server-Side Request Forgery (SSRF) vulnerability by configuring webhooks with arbitrary URLs. This issue allows the attacker to force the server to send requests to internal destinations, including private network and cloud metadata addresses. By examining delivery status codes and error messages, the attacker can probe internal services and disclose sensitive network information.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-11-05 21:57:32 UTC
|