CVE-2026-63004

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63004", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T23:10:57.032Z", "datePublished": "2026-08-21T18:05:20.458Z", "dateUpdated": "2026-08-21T19:22:22.158Z"}, "containers": {"cna": {"title": "Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj"}, {"name": "https://github.com/Unleash/unleash/commit/2100db76af3473f13e6fb40096cf17a9c2b741a1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/commit/2100db76af3473f13e6fb40096cf17a9c2b741a1"}, {"name": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1"}, {"name": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"}, {"name": "https://github.com/Unleash/unleash/releases/tag/v7.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/releases/tag/v7.5.2"}, {"name": "https://github.com/Unleash/unleash/releases/tag/v7.6.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/releases/tag/v7.6.5"}, {"name": "https://github.com/Unleash/unleash/releases/tag/v8.0.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.2"}], "affected": [{"vendor": "Unleash", "product": "unleash", "versions": [{"version": "< 7.5.2", "status": "affected"}, {"version": ">= 7.6.0, < 7.6.5", "status": "affected"}, {"version": ">= 8.0.0, < 8.0.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:05:20.458Z"}, "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2."}], "source": {"advisory": "GHSA-5vf6-jrqr-78fj", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T19:22:12.627244Z", "id": "CVE-2026-63004", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:22:22.158Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63004", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:22:12.627244Z"}}}], "references": [{"url": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:21:51.317Z"}}], "cna": {"title": "Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers", "source": {"advisory": "GHSA-5vf6-jrqr-78fj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Unleash", "product": "unleash", "versions": [{"status": "affected", "version": "< 7.5.2"}, {"status": "affected", "version": ">= 7.6.0, < 7.6.5"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.2"}]}], "references": [{"url": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj", "name": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Unleash/unleash/commit/2100db76af3473f13e6fb40096cf17a9c2b741a1", "name": "https://github.com/Unleash/unleash/commit/2100db76af3473f13e6fb40096cf17a9c2b741a1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1", "name": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d", "name": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/releases/tag/v7.5.2", "name": "https://github.com/Unleash/unleash/releases/tag/v7.5.2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/releases/tag/v7.6.5", "name": "https://github.com/Unleash/unleash/releases/tag/v7.6.5", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/releases/tag/v8.0.2", "name": "https://github.com/Unleash/unleash/releases/tag/v8.0.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:05:20.458Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63004", "state": "PUBLISHED", "dateUpdated": "2026-08-21T19:22:22.158Z", "dateReserved": "2026-07-14T23:10:57.032Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T18:05:20.458Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "unleash", "vendor": "Unleash", "versions": [{"status": "affected", "version": "< 7.5.2"}, {"status": "affected", "version": ">= 7.6.0, < 7.6.5"}, {"status": "affected", "version": ">= 8.0.0, < 8.0.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2."}, {"lang": "es", "value": "Unleash es una plataforma de gesti\u00f3n de caracter\u00edsticas de c\u00f3digo abierto. Antes de 7.5.2, 7.6.5 y 8.0.2, el subsistema de complementos e integraci\u00f3n pasa el valor parameters.url controlado por el operador de src/lib/addons/webhook.ts y las integraciones de Slack, Microsoft Teams, Datadog y New Relic a Addon.fetchRetry en src/lib/addons/addon.ts sin restringir las direcciones de loopback, link-local, privadas o de metadatos en la nube. Un actor autenticado con el permiso ra\u00edz CREATE_ADDON o UPDATE_ADDON puede hacer que el servidor env\u00ede solicitudes desde dentro de su l\u00edmite de red, usar el estado del evento de integraci\u00f3n como un or\u00e1culo de sondeo ciego, reenviar valores de Autorizaci\u00f3n, customHeaders o DD-API-KEY a un host observado por el atacante, y entregar el cuerpo JSON del evento de caracter\u00edstica a servicios internos. Este problema est\u00e1 solucionado en las versiones 7.5.2, 7.6.5 y 8.0.2."}], "id": "CVE-2026-63004", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63004", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T19:22:12.627244Z", "version": "2.0.3"}}]}, "published": "2026-08-21T19:17:30.550", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/commit/2100db76af3473f13e6fb40096cf17a9c2b741a1"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/commit/d45f99df924c0d24747b3e45e46fcda7dcd3c1c1"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/commit/d862562a5ab8f2d1e40f6519c64cf0b4fdaf806d"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/releases/tag/v7.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/releases/tag/v7.6.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-5vf6-jrqr-78fj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,7.5.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.6.0,7.6.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "unleash", "source": "cna", "vendor": "Unleash"}, "product": "unleash", "vendor": "unleash"}], "created": "2026-08-21T20:00:13.886049+00:00", "updated": "2026-08-21T21:15:06.532585+00:00", "vendors": ["unleash", "unleash$PRODUCT$unleash"]}