CVE-2026-16223 Overview
CVE-2026-16223 is a server-side request forgery (SSRF) vulnerability affecting 1Panel-dev CordysCRM versions up to 1.4.1. The flaw resides in the getSqlBotSrc function within backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java, part of the Third Party Edit Endpoint component. An authenticated remote attacker can manipulate the appSecret argument to coerce the server into issuing arbitrary outbound requests. The exploit has been publicly disclosed and may be leveraged by attackers with low-privilege access to the application.
Critical Impact
Authenticated attackers can abuse the CordysCRM Third Party Edit Endpoint to trigger server-side requests to attacker-chosen destinations, potentially exposing internal services or metadata endpoints.
Affected Products
- 1Panel-dev CordysCRM versions up to and including 1.4.1
- Component: Third Party Edit Endpoint (IntegrationConfigService.java)
- Function: getSqlBotSrc handling the appSecret parameter
Discovery Timeline
- 2026-07-19 - CVE-2026-16223 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-16223
Vulnerability Analysis
CVE-2026-16223 is classified as Server-Side Request Forgery [CWE-918]. The vulnerable getSqlBotSrc function in IntegrationConfigService.java accepts the appSecret argument without sufficient validation of the resulting request destination. When an attacker supplies a crafted value, the CordysCRM backend issues an HTTP request influenced by attacker input. This allows the attacker to reach hosts and services accessible from the CordysCRM server rather than from their own network position.
SSRF flaws in customer relationship management systems are particularly consequential when the affected host has network access to internal services, cloud metadata endpoints, or administrative interfaces. Public disclosure of the exploit increases the likelihood of opportunistic scanning against exposed CordysCRM deployments.
Root Cause
The root cause is missing validation and allowlisting of the destination URL derived from user-controlled input within the Third Party Edit Endpoint. The getSqlBotSrc handler trusts the appSecret argument during integration configuration and constructs an outbound request without confirming that the target host, scheme, or port is within an approved set.
Attack Vector
Exploitation requires network access to the CordysCRM application and low-privilege authentication. The attacker submits a manipulated appSecret parameter to the Third Party Edit Endpoint. The server then performs an outbound HTTP request using the tainted value, allowing the attacker to probe internal-only endpoints, exfiltrate response content, or interact with services that trust the CordysCRM host. Because the request originates server-side, attackers can bypass network segmentation that would block their client directly.
See the GitHub Issue #2687 for CordysCRM and GitHub Issue #2688 for CordysCRM for technical discussion.
Detection Methods for CVE-2026-16223
Indicators of Compromise
- Outbound HTTP requests from CordysCRM application hosts to internal RFC1918 addresses, 169.254.169.254 cloud metadata endpoints, or localhost ports not associated with normal integrations.
- Unusual invocations of the Third Party Edit Endpoint with atypical appSecret values that resemble URLs or hostnames.
- Application logs showing repeated integration configuration attempts from a single low-privilege user account.
Detection Strategies
- Instrument the CordysCRM backend to log the full URL destination used by getSqlBotSrc and alert on non-allowlisted hosts.
- Deploy web application firewall (WAF) rules that inspect requests to the Third Party Edit Endpoint for URL-like content in the appSecret parameter.
- Correlate authenticated CordysCRM sessions with outbound network flows to detect unexpected server-initiated connections.
Monitoring Recommendations
- Monitor egress traffic from CordysCRM servers with explicit deny rules for cloud metadata IPs and internal management ranges.
- Alert on any DNS resolution for external attacker-controlled canary domains originating from the CordysCRM host.
- Track access frequency and error rates on IntegrationConfigService endpoints to surface abuse patterns.
How to Mitigate CVE-2026-16223
Immediate Actions Required
- Restrict network egress from CordysCRM application servers to only the destinations required for legitimate integrations.
- Limit access to the Third Party Edit Endpoint to administrative roles pending vendor remediation.
- Rotate any integration secrets that may have been exposed through outbound SSRF probing.
Patch Information
At the time of publication, no fixed release has been referenced in the NVD entry for CVE-2026-16223. Track the GitHub Repository for CordysCRM and the VulDB CVE-2026-16223 entry for updates. Apply the vendor patch immediately once released and upgrade beyond version 1.4.1.
Workarounds
- Place CordysCRM behind an egress proxy that enforces an allowlist of permitted external destinations for integrations.
- Block outbound access to cloud instance metadata services (169.254.169.254) and internal management subnets from the CordysCRM host.
- Temporarily disable the Third Party Edit Endpoint if the integration configuration workflow is not actively used.
# Configuration example: iptables egress restriction for CordysCRM host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 22 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
