The strapi/strapi Core Admin / Webhook Runner component is vulnerable to a semi-blind Server-Side Request Forgery (SSRF) via webhook follow-redirect behavior. The webhook dispatcher follows HTTP redirects automatically without verifying the IP address after redirection or checking if the target is within private network ranges. Additionally, non-2xx HTTP responses from target endpoints are reflected back to the caller.