OpenCVE CVE-2026-62282

Requires an authenticated OpenCVE account (version prior to 3.0.0) that holds permission to configure notification channels; the attacker abuses the Webhook or Slack integration 'test notification' feature, which does not validate the user-supplied HTTP/HTTPS destination. No user interaction from a victim and no special server configuration is needed - the flaw is present in default builds. Limiting factors: exploitation is gated behind the notification-config privilege (PR:L), so anonymous/unauthenticated actors cannot trigger it, and impact escalates most in cloud deployments where the metadata service (169.254.169.254) is reachable from the OpenCVE host.

This is a mid-severity, real-but-not-urgent issue. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is well-supported by the description: an authenticated OpenCVE user who holds the 'configure notification channels' permission can coerce the server into making HTTP/HTTPS requests to internal hosts, localhost, link-local, and cloud metadata (169.254.169.254), then read back responses - a classic non-blind SSRF, hence C:H with no integrity or availability impact. I concur with the 6.5 score; one could argue S:C for SSRF, but for an in-application outbound fetch S:U is defensible. No EPSS score, no CISA KEV listing, and no public exploit code were provided - only the vendor fix (GHSA-ch3g-4xvr-674q, PR #747, commit, and the v3.0.0 release). Exploitation status is therefore: no public exploit identified at time of analysis. The PR:L gate (attacker must already have an account with notification-config rights) meaningfully limits blast radius and argues against widespread opportunistic exploitation; risk is highest for internet-exposed multi-user OpenCVE instances running in cloud environments where metadata endpoints expose credentials. Net: prioritize patching for cloud-hosted, multi-tenant deployments; lower urgency for single-admin or internal-only instances.

An authenticated OpenCVE user with permission to configure notification channels creates a Webhook or Slack integration pointing at http://169.254.169.254/latest/meta-data/ (or an internal service), then triggers the 'test notification' function. The OpenCVE server issues the request and returns the reachable HTTP service's response to the attacker, enabling harvesting of cloud instance credentials or internal service data. No public exploit code was identified, but the vulnerability class is trivially exploitable once the actor has the required permission.