CVE-2026-77067 omnivore-app CVE debrief

Who should care

Defenders and administrators of omnivore-app/omnivore deployments should assess exposure to internal endpoints and verify the impact of potential requests to link-local metadata addresses.

Why it matters

CVE-2026-77067 is a Server-Side Request Forgery vulnerability in omnivore-app/omnivore. Defenders should prioritize verifying exposure to internal endpoints and assessing potential impact due to lack of address validation in setWebhookResolver.

• Potential requests to link-local metadata addresses
• Repeated attacker-shaped requests to internal endpoints
• Verification of exposure to internal endpoints
• Assessment of potential impact on server logs

Technical summary

The setWebhookResolver function in packages/api/src/resolvers/webhooks/index.ts stores user-supplied URLs without validation. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts sends an axios request to that URL, potentially leading to repeated attacker-shaped requests to internal endpoints. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API. This lack of validation and logging allows an authenticated user to make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses.

Defensive priority

Defenders should prioritize verifying exposure to internal endpoints and assessing the impact of potential requests to link-local metadata addresses.

Recommended defensive actions

• Verify exposure to internal endpoints and assess potential impact
• Review and validate user-supplied URLs in the setWebhookResolver function
• Implement address validation and sanitization for user-supplied URLs
• Monitor server logs for suspicious requests to link-local metadata addresses
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source references provide details on the vulnerability, including the affected code and potential impact. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.