CVE-2026-57947CWE-918

Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration

Medium · published June 29, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N
EPSS
0.00328 · 24.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-29T17:18Z
EPSS history
Timeline
  • 29 JUN 17:18Z
    Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration
    cvelistv5