EUVD-2026-28384Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.
AnalysisAI
DNS rebinding bypass in Wallos subscription tracker allows authenticated users to exfiltrate internal network data via SSRF on 10 of 11 HTTP endpoints. Wallos 4.8.4 and prior validate webhook URLs with gethostbyname() but fail to pin DNS resolution in cURL requests, creating a time-of-check-time-of-use race window. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authenticated access to Wallos with permissions to configure webhooks or AI integration URLs (Discord notifications, Ollama host settings). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.7 (High) with network vector, low complexity, and Changed scope accurately reflects real-world risk for self-hosted deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Authenticated attacker with low-privilege Wallos account configures a malicious webhook URL (e.g., Discord notification or AI/Ollama host) pointing to attacker-controlled DNS domain rebind.attacker.com. Attacker's DNS server returns 1.2.3.4 (safe external IP) during Wallos's gethostbyname() validation check. … |
| Remediation | No vendor-released patch identified at time of analysis - CVE description explicitly states no publicly available patches exist. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Wallos deployments and confirm versions currently in use; restrict Wallos network access to trusted internal networks only via firewall rules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today