PT-2026-27470 · Wallos · Wallos

B-Hermes · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33401

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.7.0

Description Wallos is a self-hostable, open-source personal subscription tracker. An authenticated user can potentially access internal network services, cloud metadata endpoints like AWS IMDSv1, GCP, and Azure IMDS, or services bound to localhost. This is possible by providing a manipulated URL to the AI Ollama host parameter, the AI recommendations endpoint, or the notification cron job. The patch introduced in commit e8a513591 added Server-Side Request Forgery (SSRF) protection to notification test endpoints but did not cover these additional attack surfaces.

Recommendations Update to version 4.7.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33401

GHSA-R82V-P8CG-RGX3

Affected Products

Wallos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33401.json · Exploit
• https://github.com/ellite/Wallos/commit/e87387f0ebb540cd33e6dfda7181db9db650ecef · Patch
• https://github.com/ellite/Wallos/commit/e8a513591 · Patch
• https://github.com/ellite/Wallos/security/advisories/GHSA-r82v-p8cg-rgx3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33401 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33401 · Security Note