PT-2026-33790 · Vexa · Vexa

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-25883

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vexa versions prior to 0.10.0-260419-1910

Description The webhook feature allows authenticated users to configure an arbitrary URL to receive HTTP POST requests upon meeting completion. Because the application does not validate the webhook URL, it enables Server-Side Request Forgery (SSRF), a flaw where the server is tricked into making requests to unintended locations. An authenticated attacker can target internal services such as Redis, databases, and admin panels, as well as localhost services and cloud metadata endpoints for AWS or GCP to steal credentials.

Recommendations Update to version 0.10.0-260419-1910.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-25883

Affected Products

Vexa

References · 5

• https://github.com/Vexa-ai/vexa/security/advisories/GHSA-fhr6-8hff-cvg4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25883 · Security Note
• https://twitter.com/VulmonFeeds/status/2046302999270527151 · Twitter Post
• https://twitter.com/CVEnew/status/2046571933308002692 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046573076490354700 · Twitter Post