CoreWorxLab CAAL up to version 1.6.0 contains a server-side request forgery vulnerability in an unknown function within src/caal/webhooks.py, specifically in the test-hass Endpoint component. This flaw enables remote attackers to manipulate the server into making unintended requests. The vulnerability has been publicly disclosed with available exploit code. No official remediation or patch has been announced by the vendor as of the publication date.

Successful exploitation of this SSRF vulnerability could allow an unauthenticated remote attacker to make arbitrary requests from the vulnerable server, potentially accessing internal resources or services not otherwise reachable. The CVSS score of 6.9 reflects a medium impact with low attack complexity and no privileges or user interaction required. However, the actual impact depends on the internal network environment and what resources the server can access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level controls to restrict outbound requests from the affected server and monitor for suspicious activity related to SSRF attempts. Avoid exposing the vulnerable endpoint publicly until a patch or official mitigation is available.