CVE-2026-76239 eidetic-labs CVE debrief

Who should care

Users of Stigmem before 0.9.0a11, administrators of internal services, security teams monitoring for SSRF attacks, and IT personnel responsible for maintaining Stigmem server configurations should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Technical summary

Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations and trigger server-side HTTP POST requests to internal services, enabling blind SSRF attacks. This vulnerability affects Stigmem deployments prior to version 0.9.0a11 and requires immediate attention from administrators and security teams.

Defensive priority

Authenticated users can exploit this vulnerability to conduct blind SSRF attacks against internal services.

Recommended defensive actions

• Verify and limit the delivery_address parameter in webhook subscriptions
• Implement additional validation for internal loopback and private network destinations
• Monitor server-side HTTP POST requests to internal services
• Restrict authenticated users' ability to specify arbitrary delivery addresses
• Review and update Stigmem server configurations to prevent SSRF attacks
• Conduct regular security audits to identify potential SSRF vulnerabilities
• Implement network segmentation to limit the impact of potential SSRF attacks

Evidence notes

The Stigmem server fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. This issue enables attackers to trigger server-side HTTP POST requests to internal services, potentially leading to blind SSRF attacks. To verify, defenders should review webhook subscription configurations, check for suspicious delivery addresses, and monitor server-side requests.

Official resources