What is the CVSS score of CVE-2026-71271?

CVE-2026-71271 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Memos are affected by CVE-2026-71271?

A validation bypass in Memos' webhook feature allows authenticated users to exploit server-side request forgery (SSRF) and access internal-only services on the same server.

How to fix or mitigate CVE-2026-71271?

Within 24 hours, audit Memos access logs and webhook configurations for attempts targeting 0.0.0.0 or loopback addresses (127.0.0.1, ::1); correlate with any suspicious HTTP requests logged by internal services. Within 7 days, implement network-level egress filtering on the Memos server to block outbound requests to reserved IP ranges (127.0.0.0/8, 169.254.0.0/16) and internal subnets; deploy firewall rules or iptables rules on the host. Within 30 days, restrict webhook creation/execution to administrative users only as a compensating control; track Memos project for patch release and plan upgrade within 48 hours of availability.

Memos CVE-2026-71271

EUVD-2026-53356 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-05 TuranSec

GHSA-jjh5-p3gc-84xr

SSRF Memos

8.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

8.5 HIGH

Webhook registration is network-accessible and requires only a low-privileged account; Changed Scope and High Confidentiality reflect SSRF reaching loopback services outside Memos' trust boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:39 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

HIGH 8.5

DescriptionCVE.org

Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() - unlike the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go, which does. Because Linux redirects connections to 0.0.0.0 to loopback (127.0.0.1), an attacker registering a webhook URL of http://0.0.0.0:PORT/ bypasses the reserved-IP check and causes the Memos server to make outbound HTTP requests to its own loopback interface, exposing internal-only services.

AnalysisAI

Webhook URL validation bypass in Memos allows authenticated users to trigger Server-Side Request Forgery via the 0.0.0.0 address notation, causing the server to make outbound HTTP requests to its own loopback interface and exposing internal-only services, with a CVSS 8.5 score reflecting Changed Scope and High Confidentiality impact. The root cause is a code-divergence defect: isReservedIP() in internal/webhook/validate.go omits the 0.0.0.0/8 CIDR block and never calls ip.IsUnspecified(), while the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go does both. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and standard SSRF-to-loopback technique make this a realistic risk on any Linux-hosted Memos instance with multi-user access.

Technical ContextAI

Memos is an open-source self-hosted memo and note-taking web application identified by CPE cpe:2.3:a:usememos:memos:*:*:*:*:*:*:*:*. The vulnerability is a CWE-918 (Server-Side Request Forgery) rooted in incomplete IP address validation within the webhook registration subsystem. The function isReservedIP() in internal/webhook/validate.go validates candidate webhook destination IPs against a hardcoded reserved CIDR list but fails to include 0.0.0.0/8 and does not call ip.IsUnspecified(). On Linux, the kernel routes any TCP connection targeting 0.0.0.0 to the loopback interface (127.0.0.1), meaning a webhook URL of http://0.0.0.0:PORT/ passes all validation checks yet causes the Memos process to connect to itself. The explicit contrast with isInternalIP() in internal/httpgetter/html_meta.go - which correctly handles this case - indicates the two functions diverged during separate development or modification cycles rather than representing a design-level oversight. The CVSS Changed Scope metric (S:C) reflects the ability to reach services beyond Memos itself, such as unauthenticated admin APIs, Redis instances, Docker daemons, or cloud metadata endpoints bound to loopback.

RemediationAI

No vendor-released patch has been identified at time of analysis; monitor the Memos GitHub repository at https://github.com/usememos/memos for a patched release and apply it immediately upon availability. As the highest-priority compensating control, restrict webhook creation permissions to trusted administrative accounts only, directly reducing the PR:L attack surface by preventing low-privilege users from registering arbitrary URLs; the trade-off is reduced self-service capability for regular users. Implement host-level or container egress firewall rules blocking outbound HTTP connections from the Memos process to 0.0.0.0/8, 127.0.0.0/8, and any other loopback or internal CIDR ranges, so that even if a bypass is triggered the TCP connection is dropped before reaching sensitive services; note that this will also block any legitimate webhook integrations targeting internal endpoints, which must be explicitly re-permitted. Additionally, audit all existing webhook registrations in the Memos database for URLs containing 0.0.0.0 or other reserved address notations to identify whether exploitation has already occurred.