Executive brief
Omnivore is an open-source read-it-later application that allows users to subscribe to event webhooks. An authenticated attacker can register a webhook with an arbitrary URL pointing to internal network addresses or metadata endpoints. When events occur, the application will blindly send HTTP requests to these addresses without validating them first, potentially exposing sensitive internal services or cloud metadata. The attacker cannot see the responses, but can probe internal systems and potentially trigger unintended actions.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) flaw in the webhook URL handling. The setWebhookResolver function in packages/api/src/resolvers/webhooks/index.ts accepts and stores user-supplied URLs without any address validation. When events trigger, callWebhook in packages/api/src/jobs/call_webhook.ts makes axios HTTP requests to these stored URLs using attacker-controlled HTTP methods and content, with no checks against internal IP ranges or metadata endpoints. The attack requires authentication but is otherwise unrestricted. Responses are not returned to the attacker (blind SSRF), but are logged; there is no indication of a patch being available at the time of publication.
Affected products
- Omnivore Omnivore
Timeline
- 2026-08-20: disclosed