Chatwoot CVE-2026-5205

The vulnerability presents moderate real-world risk based on converging signals. CVSS score of 5.3 with low impact severity (VC:L/VI:L/VA:L) reflects limited direct damage potential, yet the presence of publicly available exploit code (E:P in vector) significantly lowers the barrier to exploitation. The requirement for authenticated access (PR:L) limits the attack surface compared to unauthenticated SSRF but remains concerning for organizations where users have legitimate Chatwoot accounts. The vendor's non-response to early disclosure and the classification as 'might be used' (per description) suggest active reconnaissance or testing may already be underway. This is not a critical RCE but rather a stepping-stone vulnerability that could enable reconnaissance of internal infrastructure, access to cloud metadata services, or lateral movement-making it a priority for environments with sensitive internal services or where Chatwoot users span multiple trust boundaries.

An authenticated Chatwoot user (such as a customer service agent or low-privileged admin account) creates or modifies a webhook trigger and supplies a malicious URL-for example, pointing to a private Kubernetes API endpoint, internal database management interface, or cloud metadata service. The Webhooks::Trigger function processes this URL without validation and the server makes an HTTP request to that destination on behalf of the attacker. The attacker receives the response, potentially revealing authentication tokens, internal service banners, or other sensitive data. Public exploit code makes this attack accessible to non-sophisticated threat actors, particularly those with social engineering access to valid user accounts.