Search
Find a vulnerability
Search criteria
1 vulnerability by goposta
CVE-2026-123204 (GCVE-0-2026-123204)
Vulnerability from cvelistv5 – Published: 2026-11-05 18:16 – Updated: 2026-11-09 17:48
VLAI
EPSS
VEX
Title
Posta before v0.18.0 SSRF via Webhook URL
Summary
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:47 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://github.com/goposta/posta/issues/282 | issue-tracking |
| https://github.com/goposta/posta/pull/315 | patchissue-tracking |
| https://github.com/goposta/posta/commit/6bb376b55… | patch |
| https://github.com/goposta/posta/releases/tag/v0.18.0 | release-notes |
| https://github.com/goposta/posta/blob/8c3cb6f89c8… | technical-description |
| https://www.vulncheck.com/advisories/posta-before… | third-party-advisory |
Date Public
2026-10-30 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:47:42.698621Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:48:51.433Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/goposta/posta",
"product": "posta",
"repo": "https://github.com/goposta/posta",
"vendor": "goposta",
"versions": [
{
"lessThan": "v0.18.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "jkaninda"
}
],
"datePublic": "2026-10-30T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T18:16:39.804Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/goposta/posta/issues/282"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/goposta/posta/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a"
},
{
"name": "posta v0.18.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/goposta/posta/releases/tag/v0.18.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/services/webhook/dispatcher.go#L321-L338"
},
{
"name": "VulnCheck Advisory: Posta before v0.18.0 SSRF via Webhook URL",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/posta-before-0.18.0-ssrf-via-webhook-url"
}
],
"title": "Posta before v0.18.0 SSRF via Webhook URL",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-123204",
"datePublished": "2026-11-05T18:16:39.804Z",
"dateReserved": "2026-11-05T17:58:51.242Z",
"dateUpdated": "2026-11-09T17:48:51.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}