Read the docs
TI-2026-85583 Aliases CVE-2026-123204GHSA-4ghw-3mh4-pmh7

Server-side request forgery in Posta webhook URLs

Priority LOW 24CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Posta before v0.18.0 contains a server-side request forgery flaw (CWE-918) in webhook creation. An authenticated user with edit rights can create webhooks with arbitrary URLs, which makes the backend send POST requests to loopback, private-network or cloud metadata addresses. The user can read delivery status codes and error strings to probe internal hosts and ports.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback, private-network or cloud metadata addresses and read delivery status codes and error strings to probe internal hosts and ports.

Why it matters now

EPSS 0.00302 23rd percentileScored 2026-11-07
Fix Fixed posta (goposta): v0.18.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
gopostapostabefore v0.18.0v0.18.0Patch availableCNA
  • posta Vendorgoposta Affected before v0.18.0 Fixed in v0.18.0 Patch available CNA

Remediation

Upgrade goposta Posta to v0.18.0, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA posta (goposta) Fixed in v0.18.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123204
  2. 2026-11-05 Alias added: GHSA-4ghw-3mh4-pmh7
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Patch 2

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences