Unscored severity · published Oct 27, 2026
CVE-2026-118172
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect
New
–
CVSS
0.2%
EPSS
No
On KEV
Description
The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Strapi Open Source and Enterprise Headless CMS · Strapi
5.51.0 · source: vendor
Affected product
SO
Strapi Open Source and Enterprise Headless CMS
Strapi
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118172
github.com
https://github.com/strapi/strapi/releases#release-v5.51.0
More from Strapi Open Source and Enterprise Headless CMS
–
CVE-2026-118171
The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint
–
CVE-2026-118170
The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whether the caller possesses update rights…