CVE-2026-71271 Details
Description
Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does.
A vulnerability in Memos' webhook URL validation allows an attacker to bypass reserved IP checks and create a server-side request forgery (SSRF) condition. The issue arises because the validation function, isReservedIP(), does not properly account for the IP range 0.0.0.0/8, which is redirected to the loopback interface (127.0.0.1) on Linux systems. This flaw enables an attacker to register a webhook URL pointing to 0.0.0.0, causing the Memos server to send outbound HTTP requests to its own loopback interface. As a result, internal services can be exposed. The vulnerability affects all versions of Memos prior to the latest release.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/usememos/memos | TuranSec | Vendor |
| https://github.com/usememos/memos/blob/main/internal/webhook/validate.go | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Memos | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |