Read the docs
TI-2026-45005 Aliases CVE-2026-63004GHSA-5vf6-jrqr-78fj

Server-side request forgery in unleash

Priority MEDIUM 58CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the addon and integration subsystem passes the operator-controlled parameters.url value from src/lib/addons/webhook.ts and the Slack, Microsoft Teams, Datadog, and New Relic integrations to Addon.fetchRetry in src/lib/addons/addon.ts without restricting loopback, link-local, private, or cloud metadata addresses. An authenticated actor with the root CREATE_ADDON or UPDATE_ADDON permission can cause the server to send requests from inside its network boundary, use integration event status as a blind probing oracle, forward Authorization, customHeaders, or DD-API-KEY values to an attacker-observed host, and deliver the feature-event JSON body to internal services. This issue is fixed in versions 7.5.2, 7.6.5, and 8.0.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed unleash (Unleash): 7.5.2, 7.6.5, 8.0.2unleash-server (npm): 7.5.2, 7.6.5, 8.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unleashunleashbefore 7.5.2; 7.6.0 to before 7.6.5; 8.0.0 to before 8.0.27.5.2, 7.6.5, 8.0.2Patch availableCNA
—unleash-server (npm)before 7.5.27.5.2Patch availableGHSA-5vf6-jrqr-78fj
—unleash-server (npm)7.6.0 to before 7.6.57.6.5Patch availableGHSA-5vf6-jrqr-78fj
—unleash-server (npm)8.0.0 to before 8.0.28.0.2Patch availableGHSA-5vf6-jrqr-78fj
  • unleash VendorUnleash Affected before 7.5.2; 7.6.0 to before 7.6.5; 8.0.0 to before 8.0.2 Fixed in 7.5.2, 7.6.5, 8.0.2 Patch available CNA
  • unleash-server (npm) Vendor— Affected before 7.5.2 Fixed in 7.5.2 Patch available GHSA-5vf6-jrqr-78fj
  • unleash-server (npm) Vendor— Affected 7.6.0 to before 7.6.5 Fixed in 7.6.5 Patch available GHSA-5vf6-jrqr-78fj
  • unleash-server (npm) Vendor— Affected 8.0.0 to before 8.0.2 Fixed in 8.0.2 Patch available GHSA-5vf6-jrqr-78fj

Remediation

  • Fix · CNA unleash (Unleash) Fixed in 7.5.2, 7.6.5, 8.0.2
  • Fix · GHSA-5vf6-jrqr-78fj unleash-server (npm) Fixed in 7.5.2 Advisory →
  • Fix · GHSA-5vf6-jrqr-78fj unleash-server (npm) Fixed in 7.6.5 Advisory →
  • Fix · GHSA-5vf6-jrqr-78fj unleash-server (npm) Fixed in 8.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63004
  2. 2026-10-03 Alias added: GHSA-5vf6-jrqr-78fj

References

Other 8

  • TI-2026-45230 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter CVSS 3.1HIGH 7.5
  • TI-2026-53733 Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVSS 4.0MEDIUM 5.3
  • TI-2026-54010 Authorization bypass in unleash CVSS 3.1MEDIUM 4.3
  • TI-2026-54011 Unleash: Missing await on permission check + cross-project IDOR in admin API CVSS 4.0HIGH 7.1
  • TI-2026-45232 Improper output encoding in unleash CVSS 3.1MEDIUM 4.1
  • TI-2026-53732 Unleash: CR-approval email renders user-controlled raw HTML CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences