CVE-2026-63004: Unleash addon webhook URL server-side request forgery

CVE-2026-63004 · Severity: medium · CVSS 5.5 · Published 2026-08-21

Unleash's feature flag service allows administrators to configure webhook integrations that send HTTP requests to external URLs when flag events occur. A user with addon management permissions can supply an internal-network URL (such as cloud metadata endpoints or localhost services) and force the Unleash server to make requests to those internal hosts, potentially exposing sensitive data like API keys and credentials. This is a blind SSRF attack—the attacker cannot see responses, but can infer success via status logging.

Technologies: Unleash. Vendors: Unleash.

Quick answers

Is CVE-2026-63004 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63004 being exploited in the wild.
How severe is CVE-2026-63004?
Medium severity, with a CVSS score of 5.5, published 21 August 2026.
Which products and versions are affected?
Unleash <= 8.0.0.
Is there a fix for CVE-2026-63004?
A patch was published on 2026-06-29: Fix committed (allowlists and private IP deny-list added in PR #12419); patched versions: 8.0.4, 7.6.5, 7.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63004 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63004?
Check whether you run Unleash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Unleash addon subsystem (webhook, Slack, Teams, Datadog, New Relic integrations) allows operators to configure a target URL via parameters.url. When a subscribed feature-flag event fires, the Unleash server issues an HTTP POST request to that URL using the ky HTTP client (src/lib/addons/addon.ts::fetchRetry), with no allow-list, deny-list, or filtering of loopback (127.0.0.1), link-local (169.254.x.x), RFC1918 private ranges, or cloud-metadata addresses. An authenticated user holding the root permissions CREATE_ADDON or UPDATE_ADDON (not the super-admin ADMIN permission, and delegable via custom role) can create or update an addon with parameters.url set to an internal target—e.g., http://169.254.169.254/latest/meta-data/ (cloud IMDS), http://127.0.0.1:&lt;port&gt;/ (localhost service), or any RFC1918 host. The configured Authorization header and arbitrary customHeaders are forwarded to the attacker's chosen URL, leaking secrets (including DD-API-KEY for Datadog integrations). The response body is not returned to the caller (blind SSRF), but the addon records whether the request succeeded and its HTTP status in the integration-event log, serving as a status/timing oracle for probing internal services. Patched in Unleash 8.0.4, 7.6.5, and 7.5.2 with URL allowlist and private-IP deny-list validation (controlled by UNLEASH_ALLOW_PRIVATE_URL_IN_INTEGRATION and UNLEASH_ALLOW_LIST_INTEGRATION environment variables).

Affected products

  • Unleash Unleash <= 8.0.0

Identifiers

  • CVE-2026-63004
  • GHSA-5vf6-jrqr-78fj

Timeline

  • 2026-08-21: disclosed: GHSA-5vf6-jrqr-78fj published on OSV
  • 2026-06-29: patched: Fix committed (allowlists and private IP deny-list added in PR #12419); patched versions: 8.0.4, 7.6.5, 7.5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.