Apache Allura CVE-2026-80181

Exploitation requires the attacker to be able to create or modify an Apache Allura webhook and supply a malicious callback URL, and to trigger the project event that fires the webhook; the SSRF then originates from the Allura server. The primary limiting factor is that webhook configuration in Allura is a project-maintainer/admin function, so despite the CVSS PR:N rating, some level of authenticated project access is realistically needed - this contradiction should be confirmed against the vendor advisory. Impact severity is further bounded by what internal services are reachable from the Allura host's network position.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, score 9.1) rates this as network-exploitable with no privileges, but this warrants scrutiny: creating or editing a webhook in Allura normally requires an authenticated project maintainer/admin account, which conflicts with PR:N - verify with the vendor, as realistic exploitation likely needs PR:L. Additionally, SSRF is predominantly a read/confidentiality primitive (C:H is well-justified for reaching internal endpoints); the I:H rating is optimistic and only holds if the SSRF can trigger state-changing internal requests. Countervailing signals: EPSS is low (0.21%), there is no CISA KEV listing, and no public exploit code is referenced, so this is a genuine-but-not-yet-widely-weaponized issue best treated as a prompt patch rather than an emergency. SSVC-style read: exploitation=none observed, automatable=likely no (requires webhook creation), technical impact=partial-to-total depending on internal reachability.

An attacker with the ability to configure a project webhook points its callback URL at an internal service or the cloud metadata endpoint (e.g. http://169.254.169.254/latest/meta-data/), then triggers the associated project event; the Allura server dispatches the request from inside the trust boundary and the attacker harvests internal responses or credentials. Because the CVSS marks AV:N/AC:L, delivery is straightforward over the network, though it hinges on webhook-configuration access. No public proof-of-concept is referenced at time of analysis.