CVE-2026-76239
MediumCVSS 6.3Summary
Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints.
Risk Assessment
SSRF attacks can enable access to internal services that are not publicly reachable, potentially leading to data exposure or further attacks.
Recommendation
Update Stigmem to version 0.9.0a11 or later, which includes a fix for the delivery_address validation.
Original NVD description (English source)
Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints.