CVE-2026-41688 Details
Description
Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the incomplete SSRF fix in Wallos validates webhook URLs via gethostbyname() but passes the original hostname to cURL without CURLOPT_RESOLVE pinning on 10 of 11 outbound HTTP endpoints, leaving a DNS rebinding TOCTOU window. At time of publication, there are no publicly available patches.
A vulnerability exists in Wallos, a personal subscription tracker, in versions prior to 4.8.4. The issue arises from an incomplete fix for server-side request forgery (SSRF) vulnerabilities. While webhook URLs are validated using 'gethostbyname()', the original hostname is passed to cURL without 'CURLOPT_RESOLVE' pinning on 10 of 11 outbound HTTP endpoints. This oversight creates a time-of-check to time-of-use (TOCTOU) vulnerability, allowing DNS rebinding attacks. At the time of publication, no patches are available.
To address this vulnerability, 'CURLOPT_RESOLVE' should be used to pin the hostname to the validated IP address for all cURL requests. Additionally, the 'is_cgnat_ip()' function should be updated to handle IPv6-mapped addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef | [email protected] | Source CodeVendor |
| https://github.com/ellite/Wallos/security/advisories/GHSA-h4g7-xv3v-q73g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ellite Wallos | <= 4.8.4 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |