CVE-2026-80350

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 12.0.7

Description An authenticated project member can perform a Server-Side Request Forgery (SSRF) by configuring a webhook with an IPv4-mapped IPv6 address. The isBlockedHostnameLiteral function within Common/Server/Utils/SSRFProtection.ts, called by SSRFProtection.validateWebhookTargetIsSafe, fails to account for the IPv4-mapped IPv6 range. Consequently, addresses such as [::ffff:127.0.0.1] bypass the security checks for private and loopback addresses. The HTTP client then treats these mapped forms as embedded IPv4 addresses, allowing the server to connect to loopback services, private network ranges, and link-local metadata endpoints, with the responses being recorded and readable via the webhook result.

Recommendations Update OneUptime to version 12.0.7.