Wallos CVE-2026-77351

Exploitation requires an authenticated Wallos user account at any privilege level - there is no guest or unauthenticated path. The attacker must have write access to their own email notification settings to store the malicious SMTP host value. The SSRF trigger is asynchronous: the outbound connection occurs when the scheduled cron job fires, not immediately upon saving, so the attacker cannot control the exact timing but can expect reliable execution on the cron interval. This is blind SSRF - TCP connection behavior and error codes may leak port-open/closed status, but HTTP response bodies are not returned to the attacker. Exploitation is further limited by the requirement that the Wallos server have network-level access to the targeted internal addresses; isolated or firewalled deployments reduce reachable targets. Unauthenticated exploitation is not possible per CVSS PR:L.

The official CVSS 3.5 base score reflects genuinely constrained impact: PR:L requires a user account, S:C captures the server-reaches-internal-network scope change, C:L reflects blind port probing rather than data exfiltration, and AC:H accounts for the asynchronous cron trigger. No EPSS score, KEV listing, or POC is available in the provided data, so real-world exploitation frequency cannot be quantified. Practical risk is meaningful primarily in multi-tenant Wallos deployments where untrusted users hold accounts and where the server has network-level access to sensitive internal resources such as cloud metadata services (169.254.169.254), internal APIs, or non-public administrative interfaces. For the common single-user self-hosted deployment, the threat model is minimal since the attacker would need to be the sole user. The AC:H in the official vector is debatable: the cron job fires on a predictable schedule, making exploitation reliable once the setting is stored, which more closely resembles AC:L behavior. No conflicting signals are present in the available data.

An attacker with any Wallos user account navigates to their personal email notification settings and stores a target internal IP address - such as 169.254.169.254 (AWS instance metadata) or an internal administrative service - as the SMTP host. When the Wallos notification cron job next executes on its configured schedule, the server initiates a TCP connection to the specified address; response timing, error behavior, or connection success can reveal whether the port is open, enabling systematic blind enumeration of the internal network topology.