EUVD-2026-64040
GHSA-5vf6-jrqr-78fj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
PR:H confirmed by required CREATE_ADDON/UPDATE_ADDON admin permission; S:C reflects server issuing cross-boundary requests; C:L and I:L reflect blind oracle and header forwarding without full system compromise.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.
AnalysisAI
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session holding the root-level CREATE_ADDON or UPDATE_ADDON permission within Unleash - this is an administrative capability not granted to standard users by default. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, score 5.5) accurately reflects that exploitation requires high privileges, but the Changed scope signals the most consequential aspect: the server crosses network trust boundaries on behalf of the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Unleash 7.5.2, 7.6.5, or 8.0.2 as appropriate for the deployed branch; release artifacts are available at https://github.com/Unleash/unleash/releases/tag/v7.5.2, https://github.com/Unleash/unleash/releases/tag/v7.6.5, and https://github.com/Unleash/unleash/releases/tag/v8.0.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers t
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first mome
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today