Omnivore CVE-2026-77067

A valid authenticated session on the Omnivore instance is required (PR:L per CVSS 4.0 vector); no administrative role is needed-the setWebhook GraphQL mutation is available to all registered users. The webhook feature must not be disabled at the application or infrastructure level. SSRF impact is substantially amplified when the Omnivore API server runs in a cloud environment with AWS IMDSv1 (or equivalent) accessible at link-local addresses, or when the server has network routes to internal services (databases, admin panels, internal APIs). The attack is blind: callWebhook discards the HTTP response and logs only success or the axios error message, so direct response-body exfiltration through the API is not possible. Exploitation is limited by: requirement for account registration, the stored-SSRF trigger model (impact depends on event frequency), blind response behavior preventing real-time read-back, and network egress controls that block private or link-local IP ranges.

The CVSS 4.0 score of 5.3 (Medium) with PR:L correctly reflects the authentication prerequisite and the blind response behavior (VC:N). However, the provided vector scores SC:N (no subsequent-system confidentiality impact), which underweights real-world cloud risk: in AWS environments with IMDSv1 enabled, each webhook-triggered axios request to 169.254.169.254 causes the metadata service to return IAM credential material that callWebhook writes to server logs on error-a meaningful confidentiality exposure on the subsequent system. The stored, event-driven nature of the SSRF means an attacker registers once and harvests on every future event trigger, making it persistent and automatable. No EPSS data was provided; the absence of a KEV listing and no confirmed public exploit suggest no observed mass exploitation. The authentication requirement (PR:L) is the primary limiting factor: exploitation requires a valid registered account. The blind response prevents direct API-path data exfiltration, which significantly constrains opportunistic attackers but does not protect against well-positioned insiders or compromised credentials in multi-tenant self-hosted deployments.

An authenticated Omnivore user registers a webhook URL of http://169.254.169.254/latest/meta-data/iam/security-credentials/ and subscribes it to a high-frequency event type such as article save. Each time the user or any automated import saves an article, callWebhook issues an axios POST to the AWS IMDSv1 metadata endpoint; in IMDSv1-enabled environments the response contains IAM role credentials in plaintext, which callWebhook writes to the server error log on non-2xx status. No public exploit code has been identified at time of analysis, but the attack requires only a registered account and standard webhook API access.