01 Record

CVE-2026-63004

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

MediumPUBLISHEDCNA: GitHub_M

Base score5.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

View raw JSON CVE Program record

02 Description

Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

03 Metadata

Published

2026-08-21 18:05Z7 HR AGO

Last updated

2026-08-21 19:22Z6 HR AGO

Reserved

2026-07-14

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

Medium (CVSS 5.5)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weaknesses

CWE-918Server-Side Request Forgery (SSRF)Base

SSVC decision

ExploitationpocAutomatablenoTechnical Impactpartial

Data version

5.2

Document digest

51048609b535372e4b20e03afdc8d440c001904e0c8d600fba264ca4e9e7d8dc

04 Affected products

VendorProductVersionsPlatforms

Unleashunleash< 7.5.2, >= 7.6.0, < 7.6.5, >= 8.0.0, < 8.0.2—

05 References

github.comhttps://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fjx_refsource_CONFIRM
github.comhttps://github.com/Unleash/unleash/commit/2100db76af3473f13e6fb40096cf17a9c2b741a1x_refsource_MISC
github.comhttps://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1x_refsource_MISC
github.comhttps://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806dx_refsource_MISC
github.comhttps://github.com/Unleash/unleash/releases/tag/v7.5.2x_refsource_MISC
github.comhttps://github.com/Unleash/unleash/releases/tag/v7.6.5x_refsource_MISC
github.comhttps://github.com/Unleash/unleash/releases/tag/v8.0.2x_refsource_MISC