CVE-2026-57947 is a server-side request forgery vulnerability affecting pinpoint-apm's pinpoint product up to version 3.1.0. The issue exists in the webhook registration endpoint, where authenticated users can register internal URLs due to missing SSRF protections. This allows attackers to trigger alarm threshold breaches that cause the server to send POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity). No official remediation or patch has been disclosed yet.

An authenticated attacker can exploit this SSRF vulnerability to cause the server to send unauthorized POST requests to internal network hosts and metadata endpoints. This may lead to unauthorized access or interaction with internal resources that are otherwise inaccessible externally. The impact is limited by the need for authentication and the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the webhook registration endpoint to trusted users only and monitor for suspicious activity related to internal URL registrations. Avoid exposing sensitive internal services that could be targeted via SSRF.