# CVE-2026-114064: Snipe-IT server-side request forgery in webhook testing

Source: https://junglewise.ai/threats/cve-2026-114064-snipe-it-before-8-7-0-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114064 · Severity: medium · CVSS 5.5 · Published 2026-10-21

Snipe-IT is an asset management platform used to track inventory and hardware across organizations. The webhook testing feature contains a flaw that lets super-admin users scan the organization's internal network to discover which hosts and ports are active, potentially revealing infrastructure otherwise hidden from them. While this requires legitimate administrative access, it could aid attackers in planning further attacks after gaining admin credentials.

Technologies: [Grokability Snipe-IT](https://junglewise.ai/threats/technologies/grokability-snipe-it). Vendors: [Grokability](https://junglewise.ai/threats/vendors/grokability).

## Quick answers

**Is CVE-2026-114064 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114064 being exploited in the wild.

**How severe is CVE-2026-114064?** Medium severity, with a CVSS score of 5.5, published 21 October 2026.

**Which products and versions are affected?** Grokability Snipe-IT before 8.7.0.

**Is there a fix for CVE-2026-114064?** Yes: fixed in 8.7.0. Until then: Restrict administrative access to Snipe-IT to trusted users only. Disable or restrict access to the webhook testing feature if not actively required, and monitor webhook configuration changes by super-admin users. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114064 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114064?** Check whether you run Grokability Snipe-IT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 8.7.0

Restrict administrative access to Snipe-IT to trusted users only. Disable or restrict access to the webhook testing feature if not actively required, and monitor webhook configuration changes by super-admin users.

## Technical details

The webhook testing endpoint performs server-side requests without restricting the target IP ranges, allowing probes to internal network addresses including 127.0.0.1 and RFC1918 ranges. By comparing HTTP response codes (4xx vs 5xx) returned from test requests to different ports, an attacker with super-admin privileges can infer port state and active hosts. The vulnerability requires high privileges (super-admin) and is exploitable over the network with no user interaction needed.

## Affected products

- Grokability Snipe-IT before 8.7.0

## Timeline

- 2026-10-06: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-wqfr-w9hp-c7v6](https://github.com/grokability/snipe-it/security/advisories/GHSA-wqfr-w9hp-c7v6)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-port-scanning-via-webhook-testing-endpoint](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-port-scanning-via-webhook-testing-endpoint)

## Related threats

- [Snipe-IT LDAP StartTLS downgrade to cleartext](https://junglewise.ai/threats/cve-2026-116200-snipe-it-before-8-6-3-ignores-the-ldap-start-tls-return-value-in)
- [Snipe-IT authentication bypass in Google SSO callback](https://junglewise.ai/threats/cve-2026-116199-snipe-it-before-8-6-3-contains-an-authentication-bypass-in)
- [Snipe-IT missing encryption in API assets endpoint](https://junglewise.ai/threats/cve-2026-116198-snipe-it-before-8-7-0-contains-a-missing-encryption)