CVE-2026-82957

Name of the Vulnerable Software and Affected Versions hyperledger-firefly versions prior to 1.4.1

Description A server-side request forgery (SSRF) exists within the Webhook Subscription component. This occurs when the url argument is manipulated in the ValidateOptions() function located in the internal/events/webhooks/webhooks.go file, allowing for remote exploitation.

Recommendations As a temporary workaround, restrict the use of the url argument in the ValidateOptions() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.