# CVE-2026-80350: OneUptime webhook SSRF via IPv4-mapped IPv6 addresses

Source: https://junglewise.ai/threats/cve-2026-80350-oneuptime-webhook-ssrf-via-ipv4-mapped-ipv6-addresses  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80350 · Severity: high · CVSS 7.1 · Published 2026-08-26

OneUptime is an open-source monitoring and observability platform. The platform's webhook feature includes security checks to prevent Server-Side Request Forgery (SSRF) attacks by blocking requests to private and loopback addresses. However, a flaw in the validation logic fails to recognize IPv4-mapped IPv6 address formats (like [::ffff:127.0.0.1]), allowing an authenticated project member to bypass these restrictions and direct the server to private networks, loopback services, or metadata endpoints—with responses stored in readable webhook logs.

Technologies: [OneUptime](https://junglewise.ai/threats/technologies/oneuptime). Vendors: [OneUptime](https://junglewise.ai/threats/vendors/oneuptime).

## Quick answers

**Is CVE-2026-80350 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80350 being exploited in the wild.

**How severe is CVE-2026-80350?** High severity, with a CVSS score of 7.1, published 26 August 2026.

**Which products and versions are affected?** OneUptime before 12.0.7.

**Is there a fix for CVE-2026-80350?** A patch was published on 2026: Version 12.0.7 adds handling for IPv4-mapped IPv6 range Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-80350 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-80350?** Check whether you run OneUptime at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an SSRF bypass in OneUptime's SSRFProtection.validateWebhookTargetIsSafe function, specifically in the isBlockedHostnameLiteral check within Common/Server/Utils/SSRFProtection.ts. The vulnerable component correctly rejects private and loopback IPv4 ranges and several IPv6 forms (unspecified, loopback, link-local, unique-local), but fails to detect the IPv4-mapped IPv6 range (::ffff:0:0/96). An attacker can supply an address like [::ffff:127.0.0.1] which passes the literal-address check (not re-validated via DNS resolution) and is then interpreted by the HTTP client as its embedded IPv4 address (127.0.0.1). Exploitation requires authentication and webhook configuration privileges. Version 12.0.7 patches the issue by adding validation for the mapped range.

## Affected products

- OneUptime OneUptime before 12.0.7

## Timeline

- 2026-08-26: disclosed
- 2026: patched: Version 12.0.7 adds handling for IPv4-mapped IPv6 range

## References

- [https://github.com/OneUptime/oneuptime](https://github.com/OneUptime/oneuptime)
- [https://github.com/OneUptime/oneuptime/blob/12.0.6/Common/Server/Utils/SSRFProtection.ts](https://github.com/OneUptime/oneuptime/blob/12.0.6/Common/Server/Utils/SSRFProtection.ts)

## Related threats

- [OneUptime authorization bypass in Kubernetes cluster operations](https://junglewise.ai/threats/cve-2026-112047-oneuptime-14-0-2-before-14-0-69-contains-an-incorrect)
- [OneUptime sandbox escape in VMRunner leading to RCE](https://junglewise.ai/threats/cve-2026-45102-oneuptime-sandbox-escape-in-vmrunner-leading-to-rce)
- [OneUptime missing authentication in Worker ManualAPI workflow execution](https://junglewise.ai/threats/cve-2026-35053-oneuptime-missing-authentication-in-worker-manualapi-workflow)
- [OneUptime SAML SSO authentication bypass via identity injection](https://junglewise.ai/threats/cve-2026-34840-oneuptime-saml-sso-authentication-bypass-via-identity-injection)
- [OneUptime missing authorization in notification API endpoints](https://junglewise.ai/threats/cve-2026-34759-oneuptime-missing-authorization-in-notification-api-endpoints)