Executive brief
Unleash is a feature-flag management service that allows administrators to configure webhook integrations to notify external systems of feature-flag events. The webhook addon subsystem fails to validate target URLs, allowing an authenticated user with addon-management permissions to configure webhooks pointing to internal services, cloud metadata endpoints, or loopback addresses. When feature-flag events trigger, the Unleash server makes HTTP requests to these attacker-chosen internal targets, disclosing configured credentials (Authorization headers, API keys) and enabling reconnaissance via success/timing oracles.
Technical details
Unleash's WebhookAddon (and derivatives Slack, Teams, Datadog, New Relic) pass operator-configured `parameters.url` directly to the `ky` HTTP client in `fetchRetry()` with no host validation. The vulnerable code path: (1) addon parameters accept a `url` field treated as a free-form string; (2) `addon-service.ts` performs no URL/host checks at create/update time; (3) `webhook.ts` forwards the raw URL and any configured `Authorization` header and `customHeaders` to `fetchRetry()`; (4) `fetchRetry()` issues the request with no filtering of loopback (127.0.0.0/8, ::1), link-local (169.254.0.0/16, fe80::/10), private (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7), or cloud-metadata addresses. Attack vector: an authenticated user holding root permission `CREATE_ADDON` or `UPDATE_ADDON` (distinct from `ADMIN` and can be delegated to non-super-admin via custom role) creates or updates an addon with `url` set to an internal target (e.g., `http://169.254.169.254/latest/meta-data/`, `http://127.0.0.1:port/`, or RFC1918 host). Triggering a subscribed event (e.g., creating a feature flag) causes the Unleash server to issue a blind POST request to that internal URL, forwarding configured secrets in headers and posting the feature-event payload. The addon records the HTTP status in the integration-event log, enabling blind-SSRF reconnaissance. Precondition: authenticated user with addon-management permission; no other user interaction required. Patched in versions 7.5.2, 7.6.5, and 8.0.2.
Affected products
- Unleash Unleash Server < 7.5.2, >= 7.6.0 and < 7.6.5, >= 8.0.0 and < 8.0.2
- unleash-server (npm) < 7.5.2, >= 7.6.0 and < 7.6.5, >= 8.0.0 and < 8.0.2
Timeline
- 2026-07-01: disclosed
- 2026-07-01: patched: Patches released for versions 7.5.2, 7.6.5, and 8.0.2
- 2026-08-21: advisory: GitHub Security Advisory GHSA-5vf6-jrqr-78fj published; CVE-2026-63004 assigned