Hemmelig CVE-2025-69206

Exploitation requires (1) an authenticated account on the Hemmelig instance (CVSS PR:L) and (2) use of the Secret Requests feature's Webhook URL field, which is where unsanitized server-side requests originate. The specific bypass techniques are DNS rebinding via domains that resolve to private IPs (e.g., localtest.me → 127.0.0.1) or abuse of open-redirect services (e.g., httpbin.org/redirect-to?url=http://127.0.0.1) - the pre-7.3.3 isPublicUrl filter validated only the literal hostname string, never the resolved IP, and did not disable HTTP redirects. Limiting factors: the attacker must be authenticated, the webhook must actually fire (triggered when a secret is submitted against the request), and real impact is constrained by what internal services the server can reach; instances on 7.3.3+ (which add DNS resolution checks and redirect:'error') are not affected.

This is a genuine but moderate-severity issue, best characterized as a high-confidence low-impact flaw rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated account (PR:L) and yielding only limited confidentiality impact with no integrity or availability effect. Exploitation status is 'publicly available exploit code exists' - the GHSA advisory includes a working PoC (localtest.me and httpbin.org redirect payloads) - but there is NO CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation; POC availability must not be conflated with in-the-wild use. No SSVC decision data was supplied. The practical risk is bounded by two factors: (1) an attacker must already be an authenticated user of the instance, and (2) the impact is SSRF (C:L) whose real-world severity depends heavily on what internal services are reachable from the Hemmelig server - classic SSRF can escalate against cloud metadata endpoints (e.g., 169.254.169.254) or unauthenticated internal admin panels, which the base CVSS does not capture. Signals are consistent with no conflicts: all sources agree this is an authenticated, limited-impact SSRF with a confirmed vendor patch.

An authenticated user of a self-hosted Hemmelig instance creates a Secret Request and sets the Webhook URL to a value that bypasses the private-IP blocklist - either a DNS-rebinding domain such as localtest.me (which resolves to 127.0.0.1) or an open-redirect like httpbin.org/redirect-to?url=http://127.0.0.1:PORT. When the webhook fires, the server issues an HTTP request to the internal target, letting the attacker reach loopback or internal-network services otherwise unreachable from outside. A public proof-of-concept demonstrating both payloads is published in the GHSA advisory.