OneUptime EUVD-2026-66389

Exploitation requires an authenticated project member account in the target OneUptime instance with permissions to create or modify webhook configurations - this is a standard project-member capability, not an elevated administrative role. The attacker must supply a webhook URL whose host component is an IPv4-mapped IPv6 address literal in bracket notation (e.g., [::ffff:10.0.0.1] or [::ffff:127.0.0.1]). No special server-side configuration is required beyond the default webhook functionality, which is a core OneUptime feature. Exploitation is bounded to authenticated project members; unauthenticated access is not possible per the CVSS PR:L vector. The range of accessible internal targets depends on what services are reachable from the OneUptime server host (loopback services on 127.x, RFC-1918 private ranges, and link-local metadata endpoints such as 169.254.169.254).

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L) is well-calibrated: PR:L correctly captures that exploitation is gated behind project membership, limiting opportunistic mass exploitation while remaining realistic for insider-threat or account-compromise scenarios. The IPv4-mapped IPv6 bypass is a well-understood technique - any attacker familiar with SSRF filter evasion can apply it without specialized tooling, making the effective AC lower than the formal AC:L label suggests. High confidentiality impact (VC:H) is accurate because webhook results are returned to the requester, allowing extraction of internal service responses including cloud metadata credentials. There is no CISA KEV listing and no public exploit code has been identified at time of analysis, suggesting this has not yet been widely exploited; EPSS data was not provided in the input. The primary realistic risk surface is multi-tenant or shared OneUptime deployments where project membership is extended to semi-trusted or external users - organizations that expose OneUptime project access broadly should treat this as urgent regardless of their size.

An authenticated project member adds a webhook in OneUptime with the target URL set to http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/, targeting the AWS EC2 instance metadata endpoint. The SSRFProtection filter evaluates the host literal, finds no match in its blocklist, and the OneUptime server dispatches the HTTP request to the metadata service. The IAM role credential response is captured as the webhook delivery result and is readable by the attacker directly through the OneUptime interface, enabling privilege escalation to cloud infrastructure.