{"id":"CVE-2026-118172","aliases":[],"title":"The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect.","titleSource":"certcc","descriptionSource":"certcc","products":[{"vendor":"Strapi","name":"Strapi Open Source and Enterprise Headless CMS","platforms":[],"versions":[{"version":"5.51.0","status":"affected"}],"source":"certcc","url":"https://www.cve.org/CVERecord?id=CVE-2026-118172"}],"remediation":[],"description":"The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.","severity":"unknown","score":null,"published":"2026-10-27T18:04:13.270Z","modified":"2026-10-27T18:04:13.270Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://github.com/strapi/strapi/releases#release-v5.51.0"],"sources":[{"name":"CVE","id":"CVE-2026-118172","modified":"2026-10-27T18:04:13.270Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118172"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:20:36.067Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}