https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T04:06:00.479347+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-00070 bdu:2026-00070 2026-10-04T04:06:00.488125+00:00 bdu:2026-00070 https://cve.radiocsirt.org/vuln/euvd-2026-260637 EUVD-2026-260637 2026-10-04T04:06:00.488182+00:00 EUVD-2026-260637 https://cve.radiocsirt.org/vuln/fkie_cve-2025-64522 fkie_cve-2025-64522 2026-10-04T04:06:00.488238+00:00

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1 fixes the vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-vwq2-jx9q-9h9f GHSA-vwq2-jx9q-9h9f — Soft Serve is vulnerable to SSRF through its Webhooks 2026-10-04T04:06:00.488310+00:00

Affected: Go: github.com/charmbracelet/soft-serve

SUMMARY

We have identified and verified an SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints.

AFFECTED COMPONENTS (VERIFIED)

1. Webhook Creation (pkg/ssh/cmd/webhooks.go:125) 2. Backend CreateWebhook (pkg/backend/webhooks.go:17) 3. Backend UpdateWebhook (pkg/backend/webhooks.go:122) 4. Webhook Delivery (pkg/webhook/webhook.go:97)

IMPACT

This vulnerability allows repository administrators to perform SSRF attacks, potentially enabling:

a) Cloud Metadata Theft - Access AWS/Azure/GCP credentials via 169.254.169.254 b) Internal Network Access - Target localhost and private networks (10.x, 192.168.x, 172.16.x) c) Port Scanning - Enumerate internal services via response codes and timing d) Data Exfiltration - Full HTTP responses stored in webhook delivery logs e) Internal API Access - Call internal admin panels and Kubernetes endpoints

PROOF OF CONCEPT

Simple example demonstrating localhost access:

```sh ssh localhost webhook create my-repo http://127.0.0.1:8080/internal \ --events push --active ```

then push to trigger.