CVE-2026-57947

HighCVSS 8.5

Published: 29/06/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

An SSRF vulnerability in Pinpoint through version 3.1.0, located in the webhook registration endpoint, allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Risk Assessment

The risk involves potential unauthorized access to internal network resources, such as cloud metadata services, which could lead to sensitive data leakage or further attack escalation within the internal network.

Recommendation

It is recommended to immediately upgrade Pinpoint to a version later than 3.1.0 that includes the SSRF fix, and to implement URL validation in webhook endpoints.

Other vulnerabilities in Pinpoint

CVE-2026-57948Medium
Pinpoint through version 3.1.0 contains an insecure session management vulnerability where the pinpointJwt session cookie lacks HttpOnly and Secure attributes. This allows attackers to access the cookie via JavaScript (document.cookie) and transmit it in cleartext over HTTP.

Original NVD description (English source)

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.