CVE-2026-56227: Capgo Webhook SSRF Vulnerability in Versions Before 12.128.2

Technical summary

CVE-2026-56227 is a server-side request forgery (SSRF) vulnerability in Capgo's webhook URL validation mechanism. The vulnerability stems from insufficient input validation that fails to block loopback addresses (127.0.0.1, ::1) and other reserved IP ranges commonly used for internal services. The flaw is classified under CWE-918 (Server-Side Request Forgery). When a webhook is triggered, the backend performs an HTTP request to the configured URL; if that URL points to a local service, the request is fulfilled and error responses are disclosed to the authenticated user, enabling reconnaissance of internal infrastructure.

Business impact

The vulnerability primarily affects multi-tenant or shared Capgo deployments where organization admins have webhook configuration privileges. An authenticated admin could map internal services, probe local APIs, or interact with backend systems not intended for external access. Because the flaw requires admin-level authentication and doesn't enable code execution or data exfiltration directly, the impact is limited to information disclosure about internal topology and service availability. Organizations heavily reliant on Capgo for critical workflow automation should assess whether admin accounts could be compromised or whether malicious insiders pose a realistic threat.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability requires administrative privileges within an organization, so it is relevant to organizations using Capgo with multiple admin-level users or shared administrative credentials. No other vendors or products are implicated in the source data provided.

Exploitability

Exploitation requires valid authentication with organization admin privileges and direct access to webhook configuration interfaces. The attack surface is therefore restricted to authenticated insiders or attackers who have compromised admin accounts. The CVSS score of 5.4 (Medium severity) reflects this requirement for prior authentication (PR:L) and the limitation to confidentiality and integrity impact without availability impact (C:L/I:L/A:N). Real-world exploitation likelihood is moderate; while not requiring user interaction or complex attack chains, it does demand elevated access and knowledge of internal service topology.

Remediation

Upgrade Capgo to version 12.128.2 or later. This release includes improved webhook URL validation that rejects loopback addresses, private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and link-local addresses (169.254.0.0/16). After patching, audit existing webhook configurations for any pointing to localhost or reserved ranges and remove or reconfigure them. Review admin account access logs for unusual webhook creation or modification activity during the period before patching.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. Verify the patch by confirming the version number in your deployment and by testing that webhook URL submission now rejects localhost and private IP addresses with an appropriate validation error message. If using a containerized or managed Capgo deployment, check with your provider for release availability and rollout timing.

Detection guidance

Monitor webhook creation and modification events in Capgo audit logs, particularly those involving localhost, 127.0.0.1, or private IP addresses (10.x, 172.16–31.x, 192.168.x). Review webhook execution logs for unusual outbound requests to loopback addresses or error messages referencing internal services. Network-level detection is limited but feasible if backend systems log unexpected inbound requests from the Capgo application server to internal addresses. Correlate webhook modifications with admin user accounts to identify potential malicious or compromised admins.

Why prioritize this

This vulnerability should be prioritized for organizations with multiple admin users, shared admin credentials, or untrusted administrator populations. The requirement for admin authentication reduces immediate risk in well-governed environments, but insider threat and account compromise scenarios warrant timely patching. The medium CVSS score and information-disclosure nature mean it is less urgent than remote unauthenticated or code-execution flaws, but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible vulnerability (AV:N) with low attack complexity (AC:L) but requiring low-privilege authentication (PR:L) and no user interaction (UI:N). The scope is unchanged (S:U), and impacts are limited to low confidentiality and integrity (C:L/I:L) with no availability impact (A:N). The medium severity is appropriate for a reconnaissance-enabling SSRF that does not lead to code execution or persistent data compromise.

Frequently asked questions