CVE-2026-57947

Name of the Vulnerable Software and Affected Versions Pinpoint versions prior to 3.1.1

Description An issue exists in the webhook registration endpoint that allows authenticated users to register internal URLs because of missing Server-Side Request Forgery (SSRF) protection. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. By triggering alarm threshold breaches, an attacker can force the server to send POST requests to internal hosts and metadata endpoints, leading to unauthorized access to internal network resources.

Recommendations Update Pinpoint to version 3.1.1 or later.