Threats tagged 'ghsa-vwq2-jx9q-9h9f'

Soft Serve versions prior to 0.11.1 contain a Server-Side Request Forgery (SSRF) vulnerability in their webhook functionality. This flaw allows repository administrators to create webhooks with URLs that are not properly validated, enabling requests to internal services, private networks, and cloud metadata endpoints. The vulnerability can lead to cloud metadata theft, internal network access, port scanning, data exfiltration through webhook logs, and unauthorized internal API access. A fix is available in version 0.11.1.