Vulnerability · Published Jun 29, 2026 · Assigned by VulnCheck

CVE-2026-57947Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration

High 8.5

In plain English

A high-severity server-side request forgery in pinpoint from pinpoint-apm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Affected products (as reported)

Vendor	Product	Versions
pinpoint-apm	pinpoint	0 – through 3.1.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

Researcher Disclosure issue-tracking
https://www.vulncheck.com/advisories/pinpoint-server-side-request-forgery-via-alarm-webhook-registration third-party-advisory