CVE-2026-80350 OneUptime CVE debrief

Who should care

Defenders responsible for OneUptime deployments, especially those using versions prior to 12.0.7, should assess their exposure to this vulnerability and take steps to mitigate the risk of SSRF attacks.

Why it matters

CVE-2026-80350 is a high-severity vulnerability in OneUptime that allows an authenticated project member to configure a webhook that directs the server at loopback services, private network ranges, and link-local metadata endpoints. Defenders should prioritize verifying exposure and taking steps to mitigate the risk of SSRF attacks.

• Potential for SSRF attacks on loopback services and private network ranges
• Risk of unauthorized access to link-local metadata endpoints
• Need for verification of OneUptime version and exposure
• Priority for upgrading to version 12.0.7 or later

Technical summary

The OneUptime webhook target check does not properly validate IPv4-mapped IPv6 addresses, allowing an authenticated project member to configure a webhook that directs the server at loopback services, private network ranges, and link-local metadata endpoints. This is due to the SSRF protection mechanism not correctly handling these types of addresses. The issue was addressed in version 12.0.7, which adds handling for the mapped range. Defenders should prioritize verifying exposure to this vulnerability, especially if using OneUptime versions prior to 12.0.7, and assess the risk of SSRF attacks in their environment.

Defensive priority

Defenders should prioritize verifying exposure to this vulnerability, especially if using OneUptime versions prior to 12.0.7, and assess the risk of SSRF attacks in their environment.

Recommended defensive actions

• Verify OneUptime version and upgrade to 12.0.7 or later if necessary
• Restrict webhook configuration to trusted users and networks
• Monitor webhook activity for suspicious requests
• Implement additional SSRF protection measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available in the source references, including GitHub advisories and Vulncheck's advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.