CVE-2026-57947: Pinpoint SSRF Vulnerability in Webhook Registration

Technical summary

CVE-2026-57947 is an SSRF vulnerability (CWE-918) affecting Pinpoint's webhook registration endpoint. The vulnerability stems from missing validation on webhook URLs during registration. Authenticated users can supply URLs pointing to internal IP ranges, localhost, or cloud metadata endpoints (e.g., 169.254.169.254). When alarm thresholds are triggered, Pinpoint initiates outbound POST requests to the registered webhook destinations. Because the server performs these requests from within the trusted internal network, it can access resources not directly reachable from the internet, including internal services, databases, and cloud metadata services that leak sensitive information such as credentials and instance role ARNs.

Business impact

This vulnerability poses a significant risk to organizations running Pinpoint, particularly those with multi-tier network architectures. Attackers with valid Pinpoint credentials can pivot from the application layer into internal infrastructure, potentially gaining access to database servers, configuration management systems, or cloud credentials. If internal metadata endpoints are reachable, attackers may extract cloud provider credentials or service roles, leading to lateral movement and privilege escalation. The vulnerability enables both information disclosure and indirect unauthorized access to critical systems.

Affected systems

Pinpoint versions 3.1.0 and earlier are vulnerable. Organizations should verify their installed Pinpoint version and prioritize patching if running 3.1.0 or any earlier release. The vulnerability requires authenticated access, so it primarily impacts organizations where user accounts may be compromised or where internal users pose an insider threat.

Exploitability

Exploitation requires valid Pinpoint authentication credentials, classifying this as a low-complexity attack from a network perspective but one that presumes account compromise or insider threat. The attack is reliable and reproducible: register a webhook pointing to an internal resource, trigger an alarm threshold condition, and observe the server's request to that internal resource. No user interaction is needed beyond initial registration. The straightforward nature of the attack—combined with the high-value targets typically residing on internal networks—makes this a moderate to high-risk issue for organizations with valuable internal services.

Remediation

Upgrade Pinpoint to a patched version that implements URL validation for webhook registration endpoints. The patch should reject URLs pointing to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8), localhost addresses, and cloud provider metadata endpoints (169.254.169.254, metadata.google.internal, etc.). As an interim mitigation, restrict network egress from the Pinpoint application server using firewall rules, DNS filtering, or network segmentation to prevent outbound connections to internal network ranges. Review and revoke any Pinpoint credentials that may have been exposed or that belong to users with untrusted access.

Patch guidance

Consult the official Pinpoint vendor advisory for the exact version number and release date of the patched release. Typical SSRF fixes include: (1) implementing a blocklist of reserved IP ranges and hostnames; (2) enforcing URL scheme validation (e.g., allowing only https:// for webhooks); (3) adding a DNS rebinding protection check; and (4) using allowlisting if only a specific set of external webhook destinations is required. Test the patch in a staging environment to confirm webhook functionality remains intact for legitimate external endpoints.

Detection guidance

Monitor Pinpoint webhook registration API logs for unusual endpoint registrations, particularly those containing IP addresses in private ranges (10.*, 172.16–31.*, 192.168.*), localhost references, or cloud metadata hostnames. Review outbound network traffic from the Pinpoint application server, flagging POST requests to internal IP ranges or metadata endpoints. Enable audit logging for alarm threshold events and correlate them with webhook registration timestamps. Set alerts on failed HTTP responses when the server attempts to reach internal hosts, as the SSRF attempt may fail but leave traces in application logs.

Why prioritize this

With a CVSS score of 8.5 (HIGH severity) and a network-exploitable attack requiring only authentication, this vulnerability warrants prompt patching. The combination of internal network access, potential credential exposure via metadata endpoints, and straightforward exploitation path makes it a priority for any organization running Pinpoint. Although KEV status is not yet assigned, the severity and ease of exploitation justify treating this as urgent.

Risk score, explained

The CVSS 3.1 score of 8.5 reflects: (1) network-accessible attack vector; (2) low attack complexity; (3) low privilege requirement (authenticated user); (4) changed scope (potential impact on other systems); (5) high confidentiality impact (access to internal resources and metadata); (6) low integrity impact (the server makes requests on behalf of the attacker but does not directly modify data); and (7) no availability impact. The score appropriately captures the threat of internal reconnaissance and credential disclosure without assuming total system compromise.

Frequently asked questions