CVE-2026-57947 is a server-side request forgery vulnerability affecting pinpoint-apm pinpoint versions up to 3.1.0. The issue exists in the webhook registration endpoint where missing SSRF protections allow authenticated users to register internal URLs. Attackers can exploit this by triggering alarm threshold breaches, causing the server to send POST requests to internal hosts and metadata endpoints. This behavior can lead to unauthorized access to internal network resources. No official remediation or patch has been confirmed as of the published date.

The vulnerability enables authenticated users to coerce the server into making unauthorized POST requests to internal network resources, including metadata endpoints. This can lead to unauthorized access to sensitive internal information or services that are not normally exposed externally. The medium CVSS score reflects the moderate risk due to the requirement for authentication and the potential impact on internal network security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the webhook registration endpoint to trusted users only and monitor for suspicious activity related to alarm threshold configurations. Avoid exposing internal URLs via webhook registrations and consider network-level controls to limit server outbound requests to internal resources.