CVE-2026-114064
Last modified
CVE-2026-114064 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe internal network addresses, including loopback and RFC1918 ranges. Attackers can point webhooks at internal hosts and ports, then compare 4xx versus 5xx responses from Test Webhooks to map open ports and active hosts.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| grokability | snipe-it | < 8.7.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-114064?
How severe is CVE-2026-114064?
How do I fix CVE-2026-114064?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-114059ArcadeDB before 26.10.1 contains a remote code execution vul…7.5
- CVE-2026-11406A vulnerability was determined in GL.iNet MT3000 up to 4.4.5…6.3
- CVE-2026-114060SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redi…4.7
- CVE-2026-114061SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site…4.7
- CVE-2026-114062SvelteKit before 3.0.0 contains a server-side request forger…5.3
- CVE-2026-114063SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains …7.5
- CVE-2026-114065Trigger.dev before 4.7.3 contains a tenant filtering bypass …6.5
- CVE-2026-114066Trigger.dev before 4.7.0 contains a missing authorization vu…8.1
- CVE-2026-114067Trigger.dev 4.5.0 before 4.6.2 contains an improper authoriz…6.5
- CVE-2026-114068Trigger.dev before 4.6.0 contains a missing authorization vu…8.3
- CVE-2026-114069Trigger.dev before 4.6.0 contains an improper authorization …8.1
- CVE-2026-11407Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vul…7.2
Are you affected by CVE-2026-114064?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST