SSRF Vulnerability in Strapi Core Admin Affecting Strapi Vendor

CVE-2026-118172

What is CVE-2026-118172?

The Strapi Core Admin and Webhook Runner package is susceptible to a semi-blind Server Side Request Forgery (SSRF) vulnerability. This occurs when the webhook dispatcher follows HTTP redirects without performing necessary post-redirect IP resolution or checks for private or link-local addresses. As a result, non-2xx responses are captured and sent back to the original caller, potentially exposing sensitive data or enabling further attacks. It is crucial for users to assess their implementations and consider mitigations to protect against such threats.

References