CVE Reports

Posted on Aug 22 Originally published at cvereports.com

CVE-2026-63004: CVE-2026-63004: Server-Side Request Forgery in Unleash Addon and Integration Subsystem

#security #cve #cybersecurity

CVE-2026-63004: Server-Side Request Forgery in Unleash Addon and Integration Subsystem

Vulnerability ID: CVE-2026-63004
CVSS Score: 5.5
Published: 2026-08-21

CVE-2026-63004 is a server-side request forgery (SSRF) vulnerability in the Unleash feature management platform. Authenticated administrators with CREATE_ADDON or UPDATE_ADDON privileges can exploit this vulnerability to initiate requests to loopback addresses, private networks, and cloud metadata endpoints, potentially leading to information disclosure and credential extraction.

TL;DR

Authenticated administrators can exploit server-side request forgery (SSRF) in Unleash integrations to access internal services and extract cloud metadata credentials.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-918
Attack Vector: Network
CVSS Score: 5.5 (Medium)
Privileges Required: High
Exploit Status: Proof of Concept
Impact: Server-Side Request Forgery & Information Disclosure

Affected Systems

Unleash Feature Management Platform
Unleash: < 7.5.2 (Fixed in: 7.5.2)
Unleash: >= 7.6.0 < 7.6.5 (Fixed in: 7.6.5)
Unleash: >= 8.0.0 < 8.0.2 (Fixed in: 8.0.2)

Code Analysis

Commit: d45f99d

Implement URL validation logic to prevent private subnet and loopback routing inside integrations.

Commit: d862562

Add DNS pinning and manual redirect controls to protect against DNS rebinding and 3xx redirect bypasses.

Commit: 2100db7

Refactor addon fetch handler to consume pinned DNS validation parameters.

Exploit Details

GitHub Security Advisory: Advisory documenting technical details and integration attack vectors.

Mitigation Strategies

Configure UNLEASH_ALLOW_PRIVATE_URL_IN_INTEGRATION=false to block outbound requests to private and local addresses
Establish an explicit integration allow-list using the UNLEASH_ALLOW_LIST_INTEGRATION environment variable
Implement host-level firewall rules to block outbound access to cloud metadata endpoints (169.254.169.254)

Remediation Steps:

Upgrade Unleash instances to versions 7.5.2, 7.6.5, or 8.0.2 or later
Audit active integration configurations and webhook definitions for unauthorized loopback or private IP destinations
Enforce network segmentation policies to restrict the server from initiating arbitrary egress connections to internal systems

References

Read the full report for CVE-2026-63004 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community