Server-Side Request Forgery Vulnerability in Ech0 by Lin Snow

CVE-2026-79671

What is CVE-2026-79671?

Ech0, prior to version 4.4.3, contains a vulnerability in the validateWebhookURL function that allows server-side request forgery (SSRF) through the use of hostnames resolving to private or internal IP addresses. This occurs because the validation process only assesses literal IP addresses using net.ParseIP() and does not sufficiently check hostname validity. An attacker with administrative access can exploit this flaw to create a webhook with a misleading hostname, enabling the server to inadvertently send requests to internal services, cloud metadata endpoints, and other private network resources.

References