CVE-2026-102877
Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
- State
- Published
- Severity
- 2.1 Low
- Published
- Sep 29, 2026
- Updated
- Sep 30, 2026
- Reserved
- Sep 29, 2026
Description
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.1 Low | CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 4.4 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
fidergetfider |
|
References
- GitHub Security Advisory (GHSA-whx4-hxwq-qgjh)vendor-advisory
- https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69patch
- https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.gotechnical-description
- https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.gotechnical-description
- fider v0.38.0 Release Notesrelease-notes
- https://github.com/getfider/fiderproduct
- VulnCheck Advisory: Fider before 0.38.0 SSRF via DNS rebinding in webhook validationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.