CVE-2026-102877CWE-918ssrf

CVE-2026-102877

Medium · published September 30, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00209 · 10.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-30T00:17Z
References (7)
https://github.com/getfider/fider · [email protected]https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go · [email protected]https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go · [email protected]https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69 · [email protected]https://github.com/getfider/fider/releases/tag/v0.38.0 · [email protected]https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh · [email protected]https://www.vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validation · [email protected]
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 20:01Z
    Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
    cvelistv5