GHSA-v55w-mmhm-9mvrMediumCVSS 5.5
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with...
🔗 CVE IDs covered (1)
📋 Description
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response.
🔗 References (9)
- https://nvd.nist.gov/vuln/detail/CVE-2026-127093
- https://github.com/rustrak/rustrak/issues/504
- https://github.com/rustrak/rustrak/pull/525
- https://github.com/rustrak/rustrak/commit/f41c464ec56954b1876062d70aef920e786ca40b
- https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/routes/alerts.rs#L422-L479
- https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/services/notification/webhook.rs#L161-L250
- https://github.com/rustrak/rustrak/releases/tag/v0.26.0
- https://www.vulncheck.com/advisories/rustrak-before-0.26.0-ssrf-via-alert-integration-test-routing-override-url
- https://github.com/advisories/GHSA-v55w-mmhm-9mvr