Executive brief
Apache Allura is an open-source project hosting platform used by organizations to manage repositories, issues, and collaborative development. A Server-Side Request Forgery (SSRF) vulnerability in its webhook functionality allows attackers to make unauthorized network requests from the server, potentially enabling access to internal systems, credential theft, or service disruption. Organizations running Allura versions prior to 1.19.1 should upgrade immediately.
Technical details
Apache Allura contains a Server-Side Request Forgery (SSRF) vulnerability in its webhooks implementation. The vulnerability allows an attacker to craft malicious webhook payloads that cause the Allura server to make arbitrary HTTP requests to internal or external addresses. This could enable attackers to access internal services, exfiltrate data from internal systems, or launch further attacks against the hosting infrastructure. The vulnerability affects all versions before 1.19.1. The fix is available in version 1.19.1 and later, and users are advised to upgrade immediately.
Affected products
- Apache Allura before 1.19.1
Timeline
- 2026-06-29: disclosed
- 2026-06-29: patched