EUVD-2026-56286
GHSA-q9jm-8x7q-2v2g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Configuring a webhook realistically needs an authenticated project-admin, so PR:L not PR:N; SSRF chiefly reads internal data (C:H) with limited integrity impact (I:L) and no availability effect.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
5DescriptionCVE.org
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).
This issue affects Apache Allura: before 1.19.1.
Users are recommended to upgrade to version 1.19.1, which fixes the issue.
AnalysisAI
Server-Side Request Forgery in Apache Allura before 1.19.1 lets attackers abuse the project webhook feature to coerce the server into issuing arbitrary outbound HTTP requests, exposing internal services and cloud metadata endpoints. The flaw carries a CVSS 9.1 and is fixed in 1.19.1; it was disclosed via the Apache security team and oss-security on 2026-08-11. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires access to Apache Allura's webhook configuration - the attacker must be able to register or modify a webhook callback URL on a project, which in normal Allura deployments implies an authenticated account with project-admin rights over at least one project (authentication requirements not fully confirmed from available data, since the vendor CVSS marks PR:N which would imply no auth). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Apache Allura to version 1.19.1, which remediates the SSRF (release note: https://allura.apache.org/posts/2026-allura-1.19.1.html; announcement: https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb and http://www.openwall.com/lists/oss-security/2026/08/11/4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache Allura deployments and confirm whether instances are running versions prior to 1.19.1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Rated high s
In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application
In Apache Allura prior to 1.11.0, a vulnerability exists for stored XSS on the user dropdown selector when creating or e
In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. Rated medium severity (CVS
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Rated medium severit
Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Rated medium severity (CVSS 4.8), this vuln
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today