CVE-2026-114064 grokability CVE debrief

Who should care

Defenders responsible for Snipe-IT installations, particularly those with internal network exposure, should assess their exposure and prioritize upgrading to version 8.7.0 or later.

Why it matters

CVE-2026-114064 is a server-side request forgery vulnerability in Snipe-IT before 8.7.0 that allows super-admin users to probe internal network addresses. Defenders should prioritize verifying exposure and upgrading to version 8.7.0 or later.

• Defenders need to verify Snipe-IT installations are upgraded to prevent internal network probing
• Restricting access to the webhook testing feature can prevent unauthorized use
• Monitoring internal network addresses can help detect potential probing attempts

Technical summary

The vulnerability is in the webhook testing feature of Snipe-IT before 8.7.0, allowing super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. This feature enables super-admin users to point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts. The vulnerability does not require authentication beyond super-admin privileges. Defenders should prioritize verifying exposure of Snipe-IT installations to internal networks and upgrading to version 8.7.0 or later.

Defensive priority

Defenders should prioritize verifying exposure of Snipe-IT installations to internal networks and upgrading to version 8.7.0 or later.

Recommended defensive actions

• Verify Snipe-IT installations are upgraded to version 8.7.0 or later
• Restrict access to the webhook testing feature to prevent unauthorized use
• Monitor internal network addresses for potential probing attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. The vulnerability is confirmed in Snipe-IT versions before 8.7.0. Defenders should verify the exposure of their Snipe-IT installations to internal networks and upgrade to version 8.7.0 or later. Evidence is limited to public CVE and source item details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.