Executive brief
CoreWorxLab CAAL is a software component used for automation and webhook management. A security flaw in its setup testing features allows an attacker to force the server to make unauthorized requests to internal network locations. This could lead to the exposure of sensitive internal data or allow an attacker to probe and interact with other private services within the organization's network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in CoreWorxLab CAAL versions up to 1.6.0 within the 'test-hass' and 'test-n8n' setup endpoints. The root cause is a lack of validation for user-supplied host and URL parameters in 'src/caal/webhooks.py', which are used to initiate outbound HTTP requests. An unauthenticated remote attacker can exploit this by providing internal IP addresses or loopback addresses (e.g., 127.0.0.1) to the '/setup/test-n8n' or '/setup/test-hass' endpoints. This allows the attacker to bypass network segmentation, probe internal services, or access cloud metadata services. Public exploit details have been disclosed, and as of the advisory date, the vendor has not provided a patch.
Affected products
- CoreWorxLab CAAL up to 1.6.0
Timeline
- 2026-04-18: disclosed: Vulnerability reported by independent researcher CPT_Penner via GitHub issue.
- 2026-05-17: advisory: CVE published and added to NVD.