# CVE-2026-118172: Strapi Core webhook semi-blind SSRF via redirect

Source: https://junglewise.ai/threats/cve-2026-118172-the-strapi-strapi-core-admin-webhook-runner-package-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-118172 · Severity: info · Published 2026-10-27

Strapi's webhook dispatcher automatically follows HTTP redirects without validating whether the target is a private or local network address. An attacker can craft a webhook that redirects to internal services, allowing them to probe or interact with systems that should not be accessible, and receive error messages that leak information about those systems.

Technologies: [Strapi](https://junglewise.ai/threats/technologies/strapi-strapi-1). Vendors: [Strapi](https://junglewise.ai/threats/vendors/strapi).

## Quick answers

**Is CVE-2026-118172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118172 being exploited in the wild.

**How severe is CVE-2026-118172?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Strapi prior to fix version unknown.

**Is there a fix for CVE-2026-118172?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118172 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118172?** Check whether you run Strapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a semi-blind server-side request forgery (SSRF) in the webhook runner component. The dispatcher lacks post-redirect IP resolution and does not enforce RFC1918 or link-local boundary checks. Non-2xx responses from target endpoints are reflected back to the caller, enabling information disclosure about internal services through error messages.

## Affected products

- Strapi Strapi prior to fix version unknown

## References

- [https://github.com/strapi/strapi/releases](https://github.com/strapi/strapi/releases)

## Related threats

- [Strapi improper authorization in API token permission reconciliation](https://junglewise.ai/threats/cve-2026-108114-strapi-5-47-0-through-5-57-0-contains-an-improper-authorization)
- [Strapi information disclosure via private field filtering](https://junglewise.ai/threats/cve-2023-22894-strapi-information-disclosure-via-private-field-filtering)