CVE-2026-67530

Name of the Vulnerable Software and Affected Versions WACRM versions prior to 0.7.1

Description An authenticated user with automation privileges can submit an arbitrary webhook URL that the server fetches without utilizing the isDeliverableUrl SSRF guard. This allows Server-Side Request Forgery (SSRF)—a technique where an attacker forces a server to make requests to an unintended location—enabling requests to private, loopback, link-local, or cloud metadata addresses, such as the cloud metadata endpoint at 169.254.169.254. The issue exists within the send webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts.

Recommendations Update to a version containing commit 23838a9959550e975d732ae08a44a3a2f0cc084b.