Server-Side Request Forgery in Omnivore Webhooks by Omnivore

CVE-2026-77067

What is CVE-2026-77067?

The Omnivore implementation of webhooks has a critical flaw in the setWebhookResolver function, where the provided URL is stored without any validation checks. This oversight allows malicious users to send various crafted requests to internal endpoints whenever a subscribed event triggers. The callWebhook function, responsible for dispatching these requests using axios, does not validate the response, recording only errors or success messages in the server logs. This situation opens the server to potential exploitation via blind SSRF attacks, compromising internal resources without proper oversight.

References