CVE-2026-118172
CVE-2026-118172
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
| Vendor | strapi |
| Product | strapi open source and enterprise headless cms |
| Published | Oct 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for strapi strapi open source and enterprise headless cms
Be the first to know when new unknown vulnerabilities affecting strapi strapi open source and enterprise headless cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Strapi / Strapi Open Source and Enterprise Headless CMS
5.51.0