Fider EUVD-2026-89412

Requires an authenticated Fider administrator who can configure the webhook feature or a custom OAuth provider's token/profile endpoint URL - these are the only user-configurable outbound-request URLs affected. The attacker must also control DNS for the configured hostname and win a DNS-rebinding race, making the name resolve to a public address during validate.WebhookURL preflight and to a private/internal address (e.g. 169.254.169.254, 10.0.0.0/8, cloud metadata) at dial time. Limiting factors: admin privilege (PR:H), high attack complexity plus a specific timing/attack requirement (AC:H/AT:P), and that instances with env.Config.AllowPrivateNetworkTargets intentionally enabled are out of scope. Fixed in v0.38.0, which enforces the IsBlockedIP check on the resolved IP at dial time so rebinding no longer bypasses it.

This is a low-priority issue despite being a network-vector SSRF (CWE-918). The vendor CVSS 4.0 score is 2.1 (Low), and the vector's own metrics explain why: AC:H and AT:P mean exploitation depends on winning a DNS-rebinding timing race between validation and connection, and PR:H means the attacker must already be a Fider administrator (only admins can configure webhook and custom OAuth provider URLs). Impact is capped at VC:L/VI:L with SC:L/SI:L - limited reads/writes against internal services or cloud metadata, not full compromise. There is no EPSS score, no CISA KEV listing, and no public exploit code identified in the provided data, so this is no public exploit identified at time of analysis. The signals are internally consistent (high-privilege, high-complexity, low impact all point the same direction); there is no CVSS-vs-description conflict to flag. Net: a legitimate defense-in-depth fix, but not an urgent operational priority given that the attacker must already hold admin control over the instance.

A Fider administrator (or someone who has compromised an admin account) configures a webhook or custom OAuth token/profile URL pointing at a hostname they control via DNS. They exploit the time-of-check/time-of-use gap so the name resolves to a public IP during Fider's preflight validation but rebinds to a private IP (e.g. 169.254.169.254 cloud metadata or an internal service) when the server actually dials, causing Fider to issue requests to internal targets. No public exploit code is identified, and the AC:H/AT:P metrics reflect the timing precision the rebinding race requires.