CVE-2026-82957mediumCWE-918

CVE-2026-82957: medium-severity vulnerability in hyperledger-firefly firefly

hyperledger-firefly Webhook Subscription webhooks.go ValidateOptions server-side request forgery

Published · Updated

Follow this CVE+ Monitor firefly

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 6.9epss 0.5%
from disclosure to weapon43 days
Published on NVDAug 31
1st PoC+43d
A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptions of the file internal/events/webhooks/webhooks.go of the component Webhook Subscription. Performing a manipulation of the argument url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
hyperledger-firefly · firefly
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.