CVE-2025-9821

LowCVSS 2.7

Published: 03/09/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Users with webhook permissions can conduct SSRF via webhooks because the destination URL is not validated. If they also have permission to view webhook logs, the (partial) request response is disclosed.

Risk Assessment

An attacker could bypass firewalls to interact with internal services, potentially leading to data disclosure or further attacks. However, this requires webhook permissions.

Recommendation

Implement validation of webhook destination URLs to prevent SSRF, following OWASP guidelines. Restrict webhook and log permissions and monitor for unusual outbound requests.

Other vulnerabilities in Webhook

CVE-2026-91080High
webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash the service.

Original NVD description (English source)

SummaryUsers with webhook permissions can conduct SSRF via webhooks. If they have permission to view the webhook logs, the (partial) request response is also disclosed DetailsWhen sending webhooks, the destination is not validated, causing SSRF. ImpactBypass of firewalls to interact with internal services. See https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ for more potential impact. Resources https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html for more information on SSRF and its fix.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS