CVE-2026-76239 — Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery_address
Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and priva…
Published: 2026-08-19 · CVSS: 5.3 · CVSS 4.0
Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause the Stigmem server to issue server-side HTTP POST requests to internal services, enabling blind SSRF attacks against localhost and private network endpoints.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7