CVE-2026-57947
Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jun 29, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jun 26, 2026
Description
Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N | VulnCheck |
| 3.1 | 8.5 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
pinpointpinpoint-apm |
|
References
- Researcher Disclosureissue-tracking
- https://www.vulncheck.com/advisories/pinpoint-server-side-request-forgery-via-alarm-webhook-registrationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.