CVE-2026-16222 Overview
CVE-2026-16222 is a server-side request forgery (SSRF) vulnerability affecting 1Panel-dev CordysCRM through version 1.4.1. The flaw resides in backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java within the Third Party Endpoint component. Attackers can manipulate the mkAddress argument to coerce the server into issuing arbitrary outbound requests. The issue is remotely exploitable and requires low-level authenticated access. A public exploit exists, and the vendor closed the report, stating the submission channel was not the official vulnerability reporting path [CWE-918].
Critical Impact
An authenticated remote attacker can abuse the mkAddress parameter in TokenService.java to force the CordysCRM backend to send crafted HTTP requests to internal or external systems, enabling reconnaissance of internal networks and access to services otherwise unreachable from outside.
Affected Products
- 1Panel-dev CordysCRM versions up to and including 1.4.1
- Component: Third Party Endpoint (TokenService.java)
- Deployment: Backend CRM integration SSO service
Discovery Timeline
- 2026-07-19 - CVE CVE-2026-16222 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16222
Vulnerability Analysis
The vulnerability exists in the single sign-on integration flow implemented by TokenService.java. The service accepts a user-controlled mkAddress argument and uses it as the destination for a server-initiated HTTP request. Because the input is not validated against an allowlist of trusted hosts, an attacker can substitute arbitrary URLs. The backend then performs the request on the attacker's behalf, returning data or triggering actions through the trusted server context. This is a classic SSRF pattern categorized under [CWE-918].
Root Cause
The root cause is missing input validation and lack of URL sanitization on the mkAddress parameter within the SSO token integration path. The application trusts the destination string supplied by an authenticated user without restricting scheme, host, or IP ranges. Internal metadata endpoints, loopback services, and private RFC1918 addresses are all reachable through the flaw.
Attack Vector
An authenticated attacker sends a request to the affected SSO integration endpoint with a manipulated mkAddress value pointing to an internal target. The CordysCRM backend then fetches the specified URL. The exploit has been publicly disclosed through VulDB and the project's GitHub issue tracker. Because the vulnerability requires only low privileges and no user interaction, mass exploitation against exposed instances is realistic.
A verified proof-of-concept code sample is not reproduced here. Refer to the GitHub Issue #2685, GitHub Issue #2686, and VulDB CVE-2026-16222 advisories for exploitation specifics.
Detection Methods for CVE-2026-16222
Indicators of Compromise
- Outbound HTTP requests from the CordysCRM backend to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or 127.0.0.1
- Requests originating from CordysCRM to cloud metadata endpoints such as 169.254.169.254
- Anomalous entries in application logs referencing TokenService with unexpected mkAddress values
- Unexpected DNS lookups from the CordysCRM host to attacker-controlled domains
Detection Strategies
- Inspect HTTP access logs for requests to the SSO integration endpoint containing user-controlled URLs in the mkAddress parameter
- Correlate application-layer requests with outbound network flows from the CordysCRM service account
- Alert on outbound connections from the CRM backend that terminate on internal subnets not typically accessed by the application
Monitoring Recommendations
- Enable verbose logging on the TokenService code path and forward logs to a centralized analytics platform
- Deploy egress filtering and log all denied outbound connections from the CordysCRM host
- Monitor for spikes in outbound request volume from the application service account
- Track authentication events preceding SSO integration calls to identify low-privilege accounts abusing the endpoint
How to Mitigate CVE-2026-16222
Immediate Actions Required
- Restrict network egress from CordysCRM backend hosts to only required external destinations
- Disable or firewall the affected SSO integration endpoint until an official patch is available
- Rotate credentials for any low-privilege accounts that may have been used to reach the vulnerable endpoint
- Audit application logs for prior manipulation of the mkAddress parameter
Patch Information
As of the last NVD update on 2026-07-20, the vendor has not released an official patch. The project closed the issue report, stating that the submission was not the official channel for reporting security vulnerabilities. Track the CordysCRM GitHub repository for future fixes and consult VulDB Vulnerability #380044 for updates.
Workarounds
- Place the CordysCRM backend behind an egress proxy that enforces an allowlist of permitted outbound hosts
- Block outbound access from the CRM host to RFC1918 ranges, 127.0.0.0/8, 169.254.0.0/16, and other sensitive internal subnets
- Apply a web application firewall rule to reject requests where mkAddress contains internal IPs, loopback, or non-HTTPS schemes
- Limit the set of accounts authorized to invoke the SSO integration functionality
# Example iptables egress restriction for the CordysCRM host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.169.254/32 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
