CVE-2026-56227 Details

A server-side request forgery (SSRF) vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability arises from the webhook URL validation process, which improperly allows loopback and internal addresses. Organization admins can set up webhooks that point to localhost or 127.0.0.1. When these webhooks are activated, the backend server makes outbound requests to these addresses, disclosing error responses to users. This behavior creates an opportunity for internal network probing and, in some environments, access to metadata services.

To address this vulnerability, Capgo should reject loopback, link-local, and private IP ranges during webhook URL validation. This includes addresses like 'localhost', '127.0.0.1', '::1', and any RFC1918 private IP ranges. After implementing these checks, the validation process should resolve hostnames to IP addresses and verify the addresses post-DNS resolution, ensuring that private or loopback addresses are not accepted. Additionally, the application should avoid returning raw network error messages to users, which could disclose sensitive internal information.