Is CVE-2026-5205 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5205 being exploited in the wild.

How severe is CVE-2026-5205?

Medium severity, with a CVSS score of 6.3, published 31 March 2026.

Is there a fix for CVE-2026-5205?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5205 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5205?

Check whether you run Chatwoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5205: Chatwoot SSRF in Webhook API

CVE-2026-5205 · Severity: medium · CVSS 6.3 · Published 2026-03-31

Chatwoot, an open-source customer engagement platform, contains a vulnerability in its webhook system. An attacker can exploit this to force the server to make unauthorized requests to internal or external systems. This could lead to the exposure of internal network information or unauthorized access to internal services that are not intended to be public.

Technologies: Chatwoot. Vendors: Chatwoot.

Quick answers

Is CVE-2026-5205 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5205 being exploited in the wild.
How severe is CVE-2026-5205?: Medium severity, with a CVSS score of 6.3, published 31 March 2026.
Which products and versions are affected?: Chatwoot up to 4.11.2.
Is there a fix for CVE-2026-5205?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5205 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5205?: Check whether you run Chatwoot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Chatwoot up to version 4.11.2 within the Webhook API component. The flaw is located in the Webhooks::Trigger function in lib/webhooks/trigger.rb, where the 'url' argument is not properly validated. A remote attacker with low privileges can manipulate this argument to force the server to initiate requests to arbitrary destinations. This can be used to scan internal networks, access metadata services, or interact with internal APIs. A public exploit is reportedly available, and as of the advisory date, the vendor has not provided a patch.

Affected products

Chatwoot Chatwoot up to 4.11.2

Timeline

2026-03-31: disclosed: Vulnerability disclosed by VulDB
2026-03-31: advisory: NVD published CVE-2026-5205

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.