CVE-2026-55190 eventschedule CVE debrief

Who should care

Defenders responsible for Event Schedule instances, especially those exposed to untrusted users, should assess the vulnerability and implement measures to prevent exploitation. This includes verifying exposure, assessing bypass feasibility, monitoring event imports, and implementing compensating controls. Additionally, security teams and vulnerability management teams should prioritize verifying exposure of Event Schedule instances and assessing the impact

Why it matters

The Event Schedule platform is vulnerable to Server-Side Request Forgery (SSRF) due to a bypass in the isUrlSafe() function. Defenders should prioritize verifying exposure, assessing bypass feasibility, monitoring event imports, and implementing compensating controls.

• Defenders need to verify exposure of Event Schedule instances to untrusted users.
• The vulnerability allows access to internal/localhost services during event import.
• Defenders should monitor for suspicious event imports.
• Remediation priority is high due to the potential for SSRF attacks.

Technical summary

The Event Schedule platform's isUrlSafe() function can be bypassed via bracketed IPv6 literals and a v4-only resolver fail-open condition, allowing access to internal/localhost services during event import. The vulnerability exists in versions 1.0.0 and prior. This can be achieved by an attacker importing events with malicious URLs, which can then be used to access internal or localhost services. The isUrlSafe() function is intended to prevent SSRF attacks but can be circumvented due to its improper handling of IPv6 literals and resolver configurations.

Defensive priority

Defenders should prioritize verifying exposure of Event Schedule instances, especially those exposed to untrusted users, and assess the feasibility of bypassing the isUrlSafe() function. They should also monitor for suspicious event imports and implement compensating controls to restrict access to internal or localhost services.

Recommended defensive actions

• Verify exposure of Event Schedule instances, especially those exposed to untrusted users
• Assess the feasibility of bypassing the isUrlSafe() function
• Monitor for suspicious event imports
• Implement compensating controls to restrict access to internal or localhost services
• Review vendor guidance for patching or mitigating the vulnerability
• Conduct an asset inventory to identify potentially affected systems
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved

Evidence notes

The CVE record and source item provide details on the SSRF vulnerability in Event Schedule. The isUrlSafe() function can be bypassed via bracketed IPv6 literals and a v4-only resolver fail-open condition. The vulnerability allows access to internal/localhost services during event import.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.