CVE-2026-8725 Details
Description
A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A server-side request forgery (SSRF) vulnerability has been identified in CoreWorxLab CAAL versions through 1.6.0. The issue resides in the test-hass and test-n8n webhook endpoints, specifically within the src/caal/webhooks.py file. These endpoints accept user-controlled input to build request URLs and perform outbound HTTP requests without proper validation. This lack of destination policy controls could allow remote exploitation, enabling attackers to probe internal network services from the affected server.
It is recommended to validate URL and host inputs on the setup test endpoints, implement strict policies to block unvalidated outbound requests, and introduce an allowlist for destination URLs. Additionally, security tests should be added to check for SSRF vulnerabilities involving localhost or private network addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 17, 2026CISA-ADP
Assessed May 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/juruo123/public_exp/issues/5 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/submit/807753 | [email protected] | Permission Required |
| https://vuldb.com/vuln/364316 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/364316/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CoreWorxLab CAAL | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 17, 2026 | New CVE Received | [email protected] |