CVE-2026-27023: Twenty CRM SSRF Bypass Vulnerability

CVE-2026-27023 Overview

CVE-2026-27023 is a Server-Side Request Forgery (SSRF) vulnerability in Twenty, an open source CRM application. The vulnerability exists in the SecureHttpClientService component, which was designed to protect against SSRF attacks by validating request URLs. However, the implementation only validated URLs at the initial request level and failed to validate redirect targets. This oversight allows authenticated attackers to bypass private IP blocking protections by redirecting requests through an attacker-controlled server.

Critical Impact

Authenticated users can bypass SSRF protections to access internal network resources, potentially exposing sensitive internal services and data that should not be accessible from the CRM application.

Affected Products

• Twenty CRM versions prior to 1.18

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-27023 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-27023

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The SecureHttpClientService in Twenty CRM was implemented to prevent SSRF attacks by blocking requests to private IP ranges and internal network addresses. However, the security control only applied to the initial URL provided in the request, leaving a critical gap in the validation logic.

When an HTTP client follows redirects, the redirect target URL was not subjected to the same private IP blocking rules. This creates a bypass scenario where an attacker can submit a request to an external URL they control, which then issues a redirect response pointing to internal resources such as cloud metadata services, internal APIs, or other sensitive endpoints within the server's network.

The vulnerability requires authentication, meaning an attacker must have valid credentials to the Twenty CRM instance to exploit this issue. However, once authenticated, the attacker can leverage features that make outbound HTTP requests, such as webhook endpoints or image URL processing, to access internal network resources.

Root Cause

The root cause of this vulnerability is incomplete URL validation in the HTTP client's redirect handling logic. The SecureHttpClientService implemented SSRF protection by checking whether the destination URL pointed to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) before making outbound requests. However, this validation was only performed on the initial request URL and not recursively applied to any redirect responses (HTTP 301, 302, 303, 307, 308).

This design flaw allows an attacker to craft a redirect chain where the initial request passes validation, but the subsequent redirect points to a blocked address, effectively bypassing the security control.

Attack Vector

The attack exploits the network-accessible CRM application and requires low privileges (authenticated user access). An attacker with control over webhook endpoints or image URLs can configure these to point to an attacker-controlled server. When the Twenty CRM application makes an outbound request to fetch the resource, the attacker's server responds with an HTTP redirect to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata or http://127.0.0.1:8080/admin).

Since the redirect target is not validated against the private IP blocklist, the CRM application follows the redirect and returns the internal resource content to the attacker. This can result in disclosure of cloud credentials, internal service data, or other sensitive information accessible from the server's network perspective.

Detection Methods for CVE-2026-27023

Indicators of Compromise

• Outbound HTTP requests from the Twenty CRM server to unusual external domains followed by connections to internal IP addresses
• Webhook or image URL configurations pointing to suspicious external servers
• HTTP redirect responses in server logs that redirect to private IP ranges or cloud metadata endpoints
• Unexpected access to cloud metadata services (e.g., 169.254.169.254) from the application server

Detection Strategies

• Monitor outbound network traffic from the CRM server for connections to private IP ranges that follow external requests
• Implement network-level logging to capture HTTP redirect chains and identify redirect-based SSRF attempts
• Review audit logs for webhook endpoint or image URL modifications by users
• Deploy web application firewall rules to detect and block requests targeting cloud metadata endpoints

Monitoring Recommendations

• Configure alerting for outbound connections to RFC 1918 private address spaces and link-local addresses from the application server
• Implement DNS logging to detect resolution of internal hostnames or private IP addresses following external domain lookups
• Enable verbose HTTP client logging in the application to capture full redirect chains for forensic analysis

How to Mitigate CVE-2026-27023

Immediate Actions Required

• Upgrade Twenty CRM to version 1.18 or later immediately
• Audit existing webhook endpoints and image URLs for any suspicious or externally-controlled URLs
• Review application logs for evidence of exploitation attempts targeting internal resources
• Consider implementing network-level egress filtering to block the application server from accessing internal services directly

Patch Information

The vulnerability has been patched in Twenty CRM version 1.18. The fix implements redirect validation to ensure all redirect targets are checked against the same private IP blocking rules applied to initial requests. Users should upgrade to version 1.18 or later by following the release notes available at the GitHub Release v1.18.0.

For full technical details on the vulnerability and the patch, refer to the GitHub Security Advisory GHSA-wm7q-rvq3-x8q9.

Workarounds

• Implement network-level egress controls to prevent the application server from connecting to internal IP ranges or cloud metadata endpoints
• Disable or restrict features that allow user-controlled outbound HTTP requests (webhooks, image fetching) until patching is complete
• Deploy a proxy for all outbound HTTP traffic that validates redirect targets before following them
• Restrict CRM user accounts to only trusted personnel until the patch is applied