PT-2026-53665 · Pinpoint Apm · Pinpoint

George Chen · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-57947

Mitre

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-57947

Produtos afetados

Pinpoint

Referências · 3

• https://github.com/pinpoint-apm/pinpoint/issues/13857 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57947 · Nota de Segurança
• https://vulncheck.com/advisories/pinpoint-server-side-request-forgery-via-alarm-webhook-registration · Nota