EUVD-2026-68910
GHSA-wq27-c6xr-6c38
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated webhook subscription request with crafted url
-
DeliveryValidateOptions processes url without SSRF safeguards
-
ExploitFirefly server issues HTTP request to internal target
-
ExecutionInternal service response returned to or observable by attacker
-
ImpactEnumerate internal network or exfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required and no user interaction is needed (CVSS 4.0 PR:N/UI:N). The attacker must be able to reach the Firefly API endpoint responsible for webhook subscription creation over the network. Exploitation is triggered by submitting a crafted url parameter to the ValidateOptions function during webhook subscription registration. The practical severity of exploitation is bounded by what internal hosts and services the Firefly server process can reach via outbound HTTP - deployments with strict egress firewall rules or outbound proxy allowlists would significantly constrain the attacker's reachable target space. Deployments that do not expose the webhook subscription API publicly, or that require application-level authentication before subscription creation, would reduce the exploitable attack surface despite the CVSS PR:N rating. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) characterizes this as a trivially exploitable, unauthenticated, network-accessible flaw with no special attack conditions required. The base score of 5.5 (Medium) reflects limited per-system impact (VC:L/VI:L/VA:L), but SSRF risk is highly context-dependent: in cloud-hosted deployments where the Firefly process can reach IMDSv1 metadata endpoints or internal APIs, a successful SSRF chain can escalate to credential theft or lateral movement. The E:P modifier confirms public exploit code exists, which lowers the skill threshold for exploitation. This is not a CISA KEV entry, so confirmed active exploitation is unverified. EPSS data was not provided. The vendor's non-response to disclosure is a negative signal for timely remediation. Real-world priority should be elevated for cloud-hosted Firefly deployments lacking egress controls, and deprioritized for air-gapped or strictly firewalled environments. |
| Exploit ScenarioDerived | An unauthenticated attacker registers a webhook subscription in an internet-exposed Hyperledger Firefly instance, supplying a url value targeting an internal service such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). When Firefly's webhook engine processes the subscription and calls ValidateOptions, it issues an HTTP GET to the attacker-controlled target URL, and the response - potentially containing cloud IAM credentials - is accessible to the attacker. A public proof-of-concept exists, reducing exploitation complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 31, 2026
Server-side request forgery in Hyperledger Firefly up to 1.4.0 allows unauthenticated remote attackers to manipulate the webhook subscription URL parameter, causing the Firefly server to issue arbitrary HTTP requests to internal or otherwise inaccessible network resources. The vulnerability resides in the ValidateOptions function within the webhook subsystem (internal/events/webhooks/webhooks.go) and is exploitable without authentication or user interaction per the CVSS 4.0 AV:N/PR:N/UI:N vector. A public proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch or response has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the reporter's disclosure attempt. Organizations running Hyperledger Firefly up to 1.4.0 should apply the following compensating controls while awaiting a fix. First, enforce network-level egress filtering on the Firefly server host to block outbound HTTP/HTTPS to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and cloud metadata IPs (169.254.169.254) - note this may disrupt legitimate webhook targets on private networks and requires testing. Second, route all Firefly outbound HTTP through an allowlist-enforcing forward proxy, permitting only pre-approved external webhook destinations; this provides finer control than IP-layer blocking but adds operational overhead. Third, if webhook subscriptions are not a required feature in your deployment, disable or restrict API access to the subscription endpoint at the load balancer or API gateway layer. Reference: https://vuldb.com/cve/CVE-2026-82957.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hyperledger Firefly is an open-source enterprise Web3 and blockchain middleware platform that provides event streaming and webhook delivery capabilities. The vulnerability is rooted in CWE-918 (Server-Side Request Forgery): the ValidateOptions function in internal/events/webhooks/webhooks.go accepts a user-supplied url argument when registering webhook subscriptions and forwards HTTP requests to that destination without adequate validation to prevent targeting of internal network addresses, loopback interfaces, cloud metadata endpoints (e.g., 169.254.169.254), or other RFC-1918 resources. No CPE string was provided in the input data, but the affected codebase is the open-source github.com/hyperledger/firefly project at versions up to and including 1.4.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible, unauthenticated SSRF with scope change as server proxies requests to internal systems; no availability impact identified.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB