PT-2026-53665 · Pinpoint Apm · Pinpoint

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-57947

Mitre

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-57947

Affected Products

Pinpoint

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-57947 · Security Note
• https://github.com/pinpoint-apm/pinpoint/issues/13857 · Note
• https://vulncheck.com/advisories/pinpoint-server-side-request-forgery-via-alarm-webhook-registration · Note