CVE-2026-76838: Hi.Events webhook SSRF via time-of-check-time-of-use

CVE-2026-76838 · Severity: high · CVSS 8.5 · Published 2026-08-24

Hi.Events is an open-source event management platform that allows administrators to configure webhooks to external systems. The platform validates webhook URLs only when they are initially registered, but not when webhooks are actually dispatched. This enables attackers to register a webhook pointing to an attacker-controlled domain, then change that domain's DNS records to redirect to internal systems (like cloud metadata endpoints or private servers), causing Hi.Events to leak sensitive internal data. The platform does not validate redirects, allowing a single HTTP redirect to reach internal systems.

Quick answers

Is CVE-2026-76838 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-76838 being exploited in the wild.
How severe is CVE-2026-76838?
High severity, with a CVSS score of 8.5, published 24 August 2026.
Which products and versions are affected?
HiEvents Hi.Events before 1.11.1-beta.
Is there a fix for CVE-2026-76838?
A patch was published on 2026: Version 1.11.1-beta includes revalidation at dispatch and full validation of redirect chains Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76838 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-76838?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a server-side request forgery (SSRF) vulnerability resulting from time-of-check-time-of-use (TOCTOU) logic in webhook validation. The NoInternalUrlRule validator in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname at registration time using gethostbyname(), checking that the resolved IP is not in private/reserved ranges; however, this validation is never repeated when webhooks are dispatched. Additionally, the Guzzle HTTP client is configured with redirect following enabled by default (no options override in backend/config/webhook-server.php), and the WebhookDispatchService does not validate redirect destinations. An attacker can register a webhook with a public domain, then change that domain's DNS record to resolve to a private/cloud metadata address (e.g., 169.254.169.254), or use a single HTTP redirect to the same target. The response body is stored in the webhook log and returned via the WebhookLogResource endpoint, allowing the attacker to read internal service responses (such as cloud provider credentials). Version 1.11.1-beta resolves this by revalidating the URL at dispatch time, pinning the validated address, checking every redirect hop, and handling IPv6 transition addresses.

Affected products

  • HiEvents Hi.Events before 1.11.1-beta

Timeline

  • 2026-08-24: disclosed
  • 2026: patched: Version 1.11.1-beta includes revalidation at dispatch and full validation of redirect chains

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.