CVE-2026-79671

Name of the Vulnerable Software and Affected Versions Ech0 versions prior to 4.4.3

Description A server-side request forgery (SSRF) issue exists in the validateWebhookURL() function within webhook setting service.go. The function only validates literal IP addresses using net.ParseIP() and does not reject hostnames that resolve via DNS to private or internal IP addresses. An attacker with admin privileges can use a specially crafted hostname to bypass this validation, forcing the server to send requests to internal services, private network resources, or cloud metadata endpoints.

Recommendations Update to version 4.4.3. As a temporary mitigation, restrict the use of the validateWebhookURL() function or limit admin privileges for webhook configuration.