What is the CVSS score of EUVD-2026-28384?

EUVD-2026-28384 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wallos are affected by EUVD-2026-28384?

Wallos subscription tracker versions 4.8.4 and prior contain a DNS rebinding vulnerability that allows authenticated users to bypass server-side request forgery (SSRF) protections and access internal…

How to fix or mitigate EUVD-2026-28384?

Within 24 hours: Inventory all Wallos deployments and confirm versions currently in use; restrict Wallos network access to trusted internal networks only via firewall rules. Within 7 days: Monitor Wallos logs for suspicious webhook URL submissions or failed SSRF attempts; evaluate interim containment such as disabling webhook functionality if operationally feasible. Within 30 days: Contact Wallos maintainers to confirm availability of patched release incorporating upstream commit e87387f0; deploy patched version (4.8.5 or later once released and verified) or migrate to alternative subscription management solution if patch timeline is unacceptable.

Wallos EUVD-2026-28384

| CVE-2026-41688 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-07 GitHub_M

SSRF Wallos

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 07, 2026 - 15:00 vuln.today

Analysis Generated

May 07, 2026 - 15:00 vuln.today

CVE Published

May 07, 2026 - 13:52 nvd

HIGH 7.7

DescriptionGitHub Advisory

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.

AnalysisAI

DNS rebinding bypass in Wallos subscription tracker allows authenticated users to exfiltrate internal network data via SSRF on 10 of 11 HTTP endpoints. Wallos 4.8.4 and prior validate webhook URLs with gethostbyname() but fail to pin DNS resolution in cURL requests, creating a time-of-check-time-of-use race window. Attackers with low-privilege accounts can exploit this to probe internal services (databases, cloud metadata endpoints, admin panels) despite SSRF defenses. EPSS not yet available for this recent CVE. No vendor-released patch at time of analysis - upstream commit e87387f0 exists but tagged release version not confirmed.

Technical ContextAI

Wallos is a PHP-based self-hosted subscription tracking application that integrates with external services (AI/Ollama hosts, Discord webhooks) via user-supplied URLs. The application attempts SSRF protection by calling gethostbyname() on user input to validate that hostnames resolve to safe IPs. However, the validate_webhook_url_for_ssrf() function returns host/port/IP data but does not enforce CURLOPT_RESOLVE pinning on 10 endpoints (ai/fetch_models.php, ai/save_settings.php, cronjobs/sendcancellationnotifications.php, etc.). This creates a DNS rebinding vulnerability (CWE-918: Server-Side Request Forgery) - an attacker controls a malicious DNS server that returns a safe IP during validation but switches to a private IP (e.g., 127.0.0.1, 169.254.169.254, internal RFC1918 addresses) when cURL executes the request milliseconds later. The commit diff shows the fix adds CURLOPT_RESOLVE to only 1 of 11 affected endpoints (ai/generate_recommendations.php) while others remain vulnerable. DNS rebinding attacks typically succeed within 100-500ms TTL windows, well within PHP script execution time.

RemediationAI

No vendor-released patch identified at time of analysis - CVE description explicitly states no publicly available patches exist. Upstream commit e87387f0ebb540cd33e6dfda7181db9db650ecef (https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef) adds CURLOPT_RESOLVE pinning to ai/generate_recommendations.php but source diff shows 10 other endpoints remain unpatched. Organizations must apply compensating controls: (1) Restrict Wallos to authenticated admin users only - disable low-privilege user accounts or segregate into least-privilege roles. Trade-off: reduces household multi-user functionality. (2) Deploy Wallos in isolated network segment with no access to internal services, cloud metadata endpoints (169.254.169.254), or RFC1918 private networks. Use firewall egress rules to whitelist only required external domains (e.g., discord.com). Trade-off: breaks AI/Ollama integration if hosted internally. (3) Implement DNS sinkholing for known rebinding domains (*.rbndr.us, *.rebinder.net) at resolver level. Trade-off: sophisticated attackers use custom domains. (4) Monitor egress traffic for anomalous internal destination IPs from Wallos container/host. Full remediation requires vendor to release version with CURLOPT_RESOLVE applied to all 11 vulnerable endpoints and validate fix independently.