Is CVE-2026-56739 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56739 being exploited in the wild.

How severe is CVE-2026-56739?

Informational severity, published 24 September 2026.

Is there a fix for CVE-2026-56739?

A patch was published on 2026-08-27: Fix merged to master, version 1.43.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56739 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56739?

Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56739: Logto SSRF in webhook and connector endpoints

CVE-2026-56739 · Severity: info · Published 2026-09-24

Logto, an open-source authentication platform, allows tenant administrators to configure outbound connections to webhooks and third-party OAuth/SAML connectors without validating that the destination addresses are safe. An attacker with admin access could point these connections to internal network resources or cloud metadata services to read sensitive data, including provider credentials. The vulnerability requires administrative configuration access but enables credential theft and unauthorized access to internal systems. Fixed in version 1.43.0.

Technologies: Logto. Vendors: Logto.

Quick answers

Is CVE-2026-56739 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56739 being exploited in the wild.
How severe is CVE-2026-56739?: Informational severity, published 24 September 2026.
Which products and versions are affected?: Logto before 1.43.0.
Is there a fix for CVE-2026-56739?: A patch was published on 2026-08-27: Fix merged to master, version 1.43.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56739 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56739?: Check whether you run Logto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Server-side request forgery (SSRF) in webhook delivery and enterprise SSO connector configuration where administrator-supplied endpoints are fetched without address validation. The vulnerability affects webhook URLs (packages/core/src/libraries/hook/utils.ts), OAuth2 userInfoEndpoint, OIDC jwksUri, and SAML metadata endpoints. An attacker with tenant admin credentials can reach loopback addresses, private IP ranges, or cloud metadata endpoints (169.254.169.254) and exfiltrate responses including OAuth access tokens and internal credentials. The fix adds IANA special-use address validation at socket connection time and introduces an SSRF_ALLOWED_ADDRESSES allowlist for legitimate internal endpoints.

Affected products

Logto Logto before 1.43.0

Timeline

2026-09-24: disclosed
2026-08-27: patched: Fix merged to master, version 1.43.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.