CVE-2026-57947: Pinpoint SSRF Vulnerability

CVE-2026-57947 Overview

CVE-2026-57947 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Pinpoint versions through 3.1.0. The flaw resides in the webhook registration endpoint used by the alarm subsystem. Authenticated users can register arbitrary internal URLs because the endpoint lacks SSRF protection. Attackers trigger alarm threshold breaches to force the Pinpoint server to issue POST requests to internal hosts and cloud metadata endpoints. This grants unauthorized reachability to internal network resources from the vantage point of the application server.

Critical Impact
Authenticated attackers can pivot into internal networks and query cloud instance metadata services through the Pinpoint server, exposing sensitive internal endpoints and credentials.

Affected Products

Pinpoint APM versions up to and including 3.1.0
Deployments exposing the alarm webhook registration endpoint to authenticated users
Cloud-hosted Pinpoint instances with reachable metadata services (AWS, Azure, GCP)

Discovery Timeline

2026-06-29 - CVE-2026-57947 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-57947

Vulnerability Analysis

Pinpoint is an open-source application performance monitoring (APM) platform. Its alarm subsystem allows users to configure webhooks that fire when defined thresholds are exceeded. The webhook registration endpoint accepts a target URL from authenticated users but performs no validation against internal address ranges, loopback interfaces, or cloud metadata hosts.

An attacker with a valid Pinpoint account registers a webhook pointing to an internal resource such as http://169.254.169.254/latest/meta-data/ or http://localhost:admin-port/. The attacker then generates conditions that breach the associated alarm threshold. Pinpoint's server then issues an outbound POST request to the attacker-specified internal endpoint from its own network position.

Because the request originates from the Pinpoint server, it bypasses network-perimeter controls that block direct external access to internal services. Attackers can enumerate internal services, reach administrative interfaces, and potentially retrieve cloud instance credentials from metadata endpoints.

Root Cause

The root cause is missing input validation and destination filtering in the webhook registration handler. The application does not enforce an allowlist of permitted hosts, does not reject RFC1918 addresses, and does not block link-local addresses used by cloud metadata services.

Attack Vector

The attack requires network access to the Pinpoint web interface and low-privileged authenticated access. Exploitation involves two steps: registering a malicious webhook URL through the alarm configuration and then triggering the alarm condition. The Pinpoint server issues the outbound POST to the attacker-controlled internal target. See the VulnCheck Security Advisory and the GitHub Issue Discussion for technical details.

// No verified public exploit code is available. See referenced advisories.

Detection Methods for CVE-2026-57947

Indicators of Compromise

Outbound HTTP POST requests from the Pinpoint server process to RFC1918 addresses, 127.0.0.1, or 169.254.169.254
Webhook entries in the Pinpoint alarm configuration referencing internal hostnames, loopback, or cloud metadata IPs
Unexpected spikes in alarm threshold breaches immediately after new webhook registrations
Access log entries on internal services showing the Pinpoint server as the source IP

Detection Strategies

Audit the alarm configuration database or API for webhook target URLs that resolve to internal or link-local addresses
Instrument egress traffic from the Pinpoint host and alert on connections to metadata endpoints or internal management ports
Correlate webhook creation events with alarm-trigger events occurring within short time windows from the same user
Review authentication logs for accounts creating multiple webhook entries followed by artificial alarm conditions

Monitoring Recommendations

Enable verbose logging on the Pinpoint alarm subsystem and forward events to a centralized SIEM
Add network detection rules for HTTP requests from application servers destined to 169.254.169.254
Monitor cloud metadata service access logs and require IMDSv2 session tokens on AWS instances
Track anomalous outbound traffic patterns from APM infrastructure to non-standard internal ports

How to Mitigate CVE-2026-57947

Immediate Actions Required

Restrict access to the Pinpoint web interface to trusted networks and enforce strong authentication for all user accounts
Review existing alarm webhook configurations and remove entries that reference internal, loopback, or metadata addresses
Enforce IMDSv2 on AWS-hosted Pinpoint deployments to require session tokens for metadata access
Apply egress filtering on the Pinpoint host to block outbound traffic to RFC1918 ranges and link-local addresses except where required

Patch Information

At the time of NVD publication, refer to the GitHub Issue Discussion and the VulnCheck Security Advisory for the current status of vendor remediation and any released fixes. Upgrade to a version beyond 3.1.0 once a patched release is available.

Workarounds

Place the Pinpoint server behind an egress proxy that enforces an allowlist of permitted webhook destinations
Deploy a network policy or security group that denies outbound traffic from the Pinpoint host to 169.254.169.254 and internal management subnets
Restrict webhook registration to administrative roles only through reverse-proxy access control until an upstream fix is applied
Remove or disable the alarm webhook feature if it is not operationally required

bash

# Example iptables egress rule blocking metadata access from the Pinpoint host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 22 -j REJECT