CVE-2026-82957: Server-Side Request Forgery in hyperledger-firefly firefly

This vulnerability exists in the ValidateOptions function within the internal/events/webhooks/webhooks.go file of hyperledger-firefly firefly versions up to 1.4.0. By manipulating the URL argument passed to this function, an attacker can trigger server-side request forgery, causing the server to initiate unintended requests to arbitrary URLs. The vulnerability is remotely exploitable without authentication. The vendor has not responded to the disclosure, and no official fix or patch is currently available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to cause the server to perform arbitrary HTTP requests. This can lead to information disclosure or interaction with internal systems not directly accessible to the attacker. The impact is rated medium based on the CVSS score of 6.9, reflecting limited but meaningful confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing network-level controls to restrict outgoing requests from the affected component and monitor for unusual webhook subscription activity. Avoid exposing the vulnerable versions to untrusted networks until an official fix is available.