–
Not scored
CVE-2026-118172
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect.
Strapi Open Source and Enterprise Headless CMSAffectedStrapi Open Source and Enterprise Headless CMS
FixNo fix listed yet.
PublishedOct 27, 18:04 · certcc
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
From certcc
Affected and fixed versions
ProductAffectedFixed inStrapi Open Source and Enterprise Headless CMS5.51.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known