PT-2026-27470 · Wallos · Wallos

B-Hermes · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33401

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.7.0

Description Wallos is a self-hostable, open-source personal subscription tracker. An authenticated user can potentially access internal network services, cloud metadata endpoints like AWS IMDSv1, GCP, and Azure IMDS, or services bound to localhost. This is possible by providing a manipulated URL to the AI Ollama host parameter, the AI recommendations endpoint, or the notification cron job. The patch introduced in commit e8a513591 added Server-Side Request Forgery (SSRF) protection to notification test endpoints but did not cover these additional attack surfaces.

Recommendations Update to version 4.7.0 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-33401

GHSA-R82V-P8CG-RGX3

Produtos afetados

Wallos

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33401.json · Exploit
• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef · Correção
• https://github.com/ellite/Wallos/commit/e8a513591 · Correção
• https://github.com/ellite/Wallos/security/advisories/GHSA-r82v-p8cg-rgx3 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33401 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33401 · Nota de Segurança