Vulnerability · Published Nov 5, 2026 · Assigned by VulnCheck

CVE-2026-123204Posta before v0.18.0 SSRF via Webhook URL

Medium 4.3

In plain English

A medium-severity server-side request forgery in posta from goposta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 77.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.

Affected products (as reported)

Vendor	Product	Versions
goposta	posta	0 – before v0.18.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/goposta/posta/issues/282 issue-tracking
https://github.com/goposta/posta/pull/315 patch, issue-tracking
https://github.com/goposta/posta/commit/6bb376b55dcfdcb979040ed42c4bf57b99e4f46a patch
posta v0.18.0 Release Notes release-notes
https://github.com/goposta/posta/blob/8c3cb6f89c8a992329fac21491c38aed70d05c73/internal/services/webhook/dispatcher.go#L321-L338 technical-description
VulnCheck Advisory: Posta before v0.18.0 SSRF via Webhook URL third-party-advisory