CVE-2026-61640: CWE-918: Server-Side Request Forgery (SSRF) in ellite Wallos

Wallos versions before 4.9.6 contain an SSRF vulnerability (CWE-918) in the handling of OpenID Connect (OIDC) URLs. Specifically, the admin-configured token_url and user_info_url parameters are passed directly to curl_init() without validation or filtering against SSRF attacks. Unlike other URLs in the application that use validate_webhook_url_for_ssrf(), these OIDC URLs bypass all SSRF protections. An attacker with admin privileges can set these URLs to internal network addresses (e.g., http://169.254.169.254/latest/meta-data/) to access sensitive internal cloud metadata or pivot within the internal network. The issue was fixed in Wallos version 4.9.6.

An attacker with administrative privileges can exploit this vulnerability to perform SSRF attacks by configuring OIDC URLs to access internal network resources or cloud metadata endpoints. This can lead to unauthorized information disclosure and potential internal network pivoting. The CVSS 4.0 base score is 8.5 (high severity), reflecting the network attack vector, low attack complexity, and high impact on confidentiality and integrity.

This vulnerability has been patched in Wallos version 4.9.6. Users should upgrade to version 4.9.6 or later to remediate the issue. No other mitigation guidance is provided or necessary as the fix addresses the root cause by adding SSRF protections to OIDC URLs.