Is CVE-2026-80350 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80350 being exploited in the wild.

How severe is CVE-2026-80350?

High severity, with a CVSS score of 7.1, published 26 August 2026.

Is there a fix for CVE-2026-80350?

A patch was published on 2026: Version 12.0.7 adds handling for IPv4-mapped IPv6 range Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-80350 attacked?

It is attacked over the network.

Am I affected by CVE-2026-80350?

Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80350: OneUptime webhook SSRF via IPv4-mapped IPv6 addresses

CVE-2026-80350 · Severity: high · CVSS 7.1 · Published 2026-08-26

OneUptime is an open-source monitoring and observability platform. The platform's webhook feature includes security checks to prevent Server-Side Request Forgery (SSRF) attacks by blocking requests to private and loopback addresses. However, a flaw in the validation logic fails to recognize IPv4-mapped IPv6 address formats (like [::ffff:127.0.0.1]), allowing an authenticated project member to bypass these restrictions and direct the server to private networks, loopback services, or metadata endpoints—with responses stored in readable webhook logs.

Technologies: OneUptime. Vendors: OneUptime.

Quick answers

Is CVE-2026-80350 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80350 being exploited in the wild.
How severe is CVE-2026-80350?: High severity, with a CVSS score of 7.1, published 26 August 2026.
Which products and versions are affected?: OneUptime before 12.0.7.
Is there a fix for CVE-2026-80350?: A patch was published on 2026: Version 12.0.7 adds handling for IPv4-mapped IPv6 range Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-80350 attacked?: It is attacked over the network.
Am I affected by CVE-2026-80350?: Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an SSRF bypass in OneUptime's SSRFProtection.validateWebhookTargetIsSafe function, specifically in the isBlockedHostnameLiteral check within Common/Server/Utils/SSRFProtection.ts. The vulnerable component correctly rejects private and loopback IPv4 ranges and several IPv6 forms (unspecified, loopback, link-local, unique-local), but fails to detect the IPv4-mapped IPv6 range (::ffff:0:0/96). An attacker can supply an address like [::ffff:127.0.0.1] which passes the literal-address check (not re-validated via DNS resolution) and is then interpreted by the HTTP client as its embedded IPv4 address (127.0.0.1). Exploitation requires authentication and webhook configuration privileges. Version 12.0.7 patches the issue by adding validation for the mapped range.

Affected products

OneUptime OneUptime before 12.0.7

Timeline

2026-08-26: disclosed
2026: patched: Version 12.0.7 adds handling for IPv4-mapped IPv6 range

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.