CVE-2026-77067

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An authenticated user can trigger the server to send repeated requests to internal endpoints, including link-local metadata addresses. This occurs because the setWebhookResolver function in packages/api/src/resolvers/webhooks/index.ts stores a user-supplied url without performing address validation. When a subscribed event is triggered, the callWebhook() function in packages/api/src/jobs/call webhook.ts executes an axios.request using the stored url, the recorded method, and the Content-Type. The process is blind, as the callWebhook() function discards the response and only logs the success or error, meaning the response is not returned via the API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.