CVE-2026-61638: Wallos Self-Hosted Tracker SSRF Vulnerability

CVE-2026-61638 Overview

Wallos is an open-source, self-hostable personal subscription tracker. Versions prior to 4.9.6 contain a Server-Side Request Forgery (SSRF) vulnerability in the email notification test endpoint. The POST /endpoints/notifications/testemailnotifications.php handler accepts smtpaddress and smtpport parameters from the request body without SSRF validation. PHPMailer then connects to the attacker-supplied host and port. While every other notification endpoint in Wallos uses ssrf_helper.php, the email endpoint was missed during initial hardening. Any authenticated user can abuse this flaw to probe internal network services and query cloud metadata endpoints. The issue is tracked as [CWE-918] and patched in version 4.9.6.

Critical Impact
An authenticated attacker can force the Wallos server to initiate arbitrary TCP connections, enabling internal network reconnaissance and access to cloud instance metadata services.

Affected Products

Wallos self-hosted subscription tracker
All versions prior to 4.9.6
Deployments running the testemailnotifications.php endpoint

Discovery Timeline

2026-08-31 - CVE-2026-61638 published to NVD
2026-09-01 - Last updated in NVD database
v4.9.6 - Fix released by the Wallos maintainers

Technical Details for CVE-2026-61638

Vulnerability Analysis

The vulnerability resides in the SMTP test-connection workflow. When an authenticated user submits a test-email request, the endpoint reads smtpaddress and smtpport directly from the POST body. It then instantiates PHPMailer and initiates an SMTP handshake against the supplied destination. Because no validation restricts the target host or port, the server acts as a proxy for arbitrary outbound TCP connections. Attackers can enumerate internal services, identify open ports on RFC1918 hosts, and reach cloud provider metadata endpoints such as 169.254.169.254. Response timing and error messages returned to the caller expose whether a given host and port combination is reachable.

Root Cause

The root cause is missing SSRF validation on user-controlled connection parameters. Other notification endpoints in Wallos already include require_once '../../includes/ssrf_helper.php'; to filter destinations, but the email test path was omitted. Without a host allowlist or private-IP block, PHPMailer follows any destination the caller specifies.

Attack Vector

Exploitation requires only an authenticated session on the Wallos instance. The attacker sends a crafted POST request setting smtpaddress to an internal IP address or metadata host and smtpport to any TCP port of interest. The server's connection attempt and resulting error surface enough information to fingerprint internal services and retrieve metadata content over SMTP-adjacent channels.

php

// Patch pattern applied in v4.9.6 (illustrative, matches the fix in
// endpoints/admin/saveoidcsettings.php in the same commit)
require_once '../../includes/connect_endpoint.php';
require_once '../../includes/validate_endpoint_admin.php';
require_once '../../includes/ssrf_helper.php';

$postData = file_get_contents("php://input");
$data = json_decode($postData, true);

Source: GitHub Commit b75f13d

Detection Methods for CVE-2026-61638

Indicators of Compromise

POST requests to /endpoints/notifications/testemailnotifications.php containing smtpaddress values pointing at RFC1918 ranges, loopback, or 169.254.169.254.
Outbound connections from the Wallos application host to internal subnets or cloud metadata IPs on non-SMTP ports.
Repeated test-email requests from a single authenticated session iterating through host and port combinations.

Detection Strategies

Inspect web server access logs for the vulnerable endpoint and correlate the source session with the submitted SMTP parameters.
Baseline expected SMTP destinations for the Wallos service and alert on deviations, especially non-routable or metadata addresses.
Monitor PHP-FPM or container egress for TCP SYN traffic to unusual internal targets originating from the Wallos process.

Monitoring Recommendations

Forward Wallos application and reverse-proxy logs to a centralized analytics platform for correlation with network telemetry.
Enable egress netflow or eBPF-based process-to-connection mapping on the Wallos host to attribute outbound sockets to PHP workers.
Alert on any successful TCP connect from Wallos to cloud metadata endpoints regardless of port.

How to Mitigate CVE-2026-61638

Immediate Actions Required

Upgrade Wallos to version 4.9.6 or later without delay.
Rotate any secrets or cloud instance credentials that may have been exposed via metadata access from the Wallos host.
Review authentication logs and disable any accounts showing anomalous use of notification test endpoints.

Patch Information

The fix is available in Wallos v4.9.6. Additional context is provided in GitHub Pull Request #1092 and the GHSA-f8r5-v75m-385h advisory. The patch adds ssrf_helper.php validation to the email notification path, aligning it with the other notification endpoints.

Workarounds

Restrict network egress from the Wallos container or host to only the SMTP relays required for operation.
Block outbound traffic to 169.254.169.254 and other cloud metadata endpoints via host firewall rules or a network policy.
Limit administrative access to the Wallos instance and enforce strong authentication until the patched version is deployed.

bash

# Example egress restriction using iptables on the Wallos host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp ! --dport 587 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp ! --dport 587 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp ! --dport 587 -j DROP