CVE-2026-71250: Firefly III Webhook SSRF Vulnerability

CVE-2026-71250 Overview

CVE-2026-71250 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Firefly III's webhook URL validator (IsValidWebhookUrl.php). The validator filters most private and reserved IPv4 ranges but contains an early-return branch that permits any address in 127.0.0.0/8. An authenticated user with webhooks enabled can configure a webhook that targets loopback services on the host. The same validator resolves the target hostname once via gethostbyname(), while the outbound sender (StandardWebhookSender.php) re-resolves the hostname independently through Guzzle at send time. This time-of-check to time-of-use (TOCTOU) gap enables DNS rebinding against internal addresses.

Critical Impact
Authenticated users can coerce the Firefly III server into issuing blind HTTP requests to loopback and internal network services, bypassing the intended private-range filter.

Affected Products

Firefly III (self-hosted personal finance manager)
Deployments with the webhooks feature enabled (disabled by default)
Instances exposing webhook configuration to authenticated users

Discovery Timeline

2026-08-05 - CVE-2026-71250 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71250

Vulnerability Analysis

The flaw combines two defects in Firefly III's webhook subsystem. First, IsValidWebhookUrl.php enumerates disallowed private and reserved IPv4 ranges but returns early for addresses in 127.0.0.0/8, effectively whitelisting the entire loopback range. An authenticated user can point a webhook at http://127.0.0.1:<port>/ to reach services co-located on the host, such as internal admin panels, metrics endpoints, or unauthenticated management APIs.

Second, the validator performs a single gethostbyname() lookup at configuration time. The actual HTTP dispatch in StandardWebhookSender.php uses Guzzle, which resolves the hostname again when the request is sent. An attacker who controls a DNS name can serve a public IP during validation and a private or internal IP when the webhook fires. The response body is written only to a server-side debug log and never returned to the requester, making this a blind SSRF primitive.

Root Cause

The root cause is inconsistent host validation logic combined with an incomplete deny list. The loopback range is explicitly bypassed rather than blocked, and hostname resolution is not pinned between validation and transmission.

Attack Vector

Exploitation requires an authenticated Firefly III account and the webhooks feature to be enabled. The attacker either supplies a literal 127.0.0.0/8 address or registers a hostname whose DNS record flips between a public and a private answer. On trigger, Firefly III performs an outbound HTTP request from its own network context to the attacker-chosen internal endpoint. Because responses are not surfaced to the user, the impact is limited to state-changing or observable side effects against internal services, aligning with the low integrity impact and no confidentiality impact reflected in the vector.

No public exploit code is available. Refer to the Firefly III GitHub repository for source-level context.

Detection Methods for CVE-2026-71250

Indicators of Compromise

Webhook configurations whose target host resolves to 127.0.0.0/8, RFC1918, or link-local ranges.
Outbound HTTP requests originating from the Firefly III process to loopback ports or internal service addresses.
DNS queries from the Firefly III host that resolve the same webhook hostname to different IPs within a short interval.
Debug log entries in Firefly III showing webhook responses from internal endpoints.

Detection Strategies

Inspect the webhooks database table for URLs containing 127., localhost, or hostnames not on an approved allowlist.
Correlate webhook trigger events with process-level network telemetry to identify requests to non-public destinations.
Alert on DNS resolutions from the Firefly III host that return private-range answers for externally supplied hostnames.

Monitoring Recommendations

Enable and forward Firefly III application and webhook debug logs to a central log platform for review.
Baseline the set of destinations the Firefly III host normally contacts and flag deviations.
Monitor authentication events for accounts that create or modify webhooks, especially newly created users.

How to Mitigate CVE-2026-71250

Immediate Actions Required

Disable the webhooks feature in Firefly III unless it is required for operational workflows.
Audit existing webhook definitions and remove any pointing to loopback, private, or unresolved hosts.
Restrict webhook creation to trusted administrator accounts through role or account review.
Upgrade to a Firefly III release that fixes the loopback bypass and pins DNS resolution between validation and send.

Patch Information

At publication, no fixed version is listed in the NVD record. Monitor the Firefly III GitHub repository for release notes addressing the webhook validator and StandardWebhookSender behavior, and apply the update once available.

Workarounds

Place Firefly III behind an egress proxy that blocks requests to 127.0.0.0/8, RFC1918, and link-local ranges regardless of the resolved hostname.
Run the application in a network namespace or container with no route to internal management interfaces or loopback services other than its own dependencies.
Configure the host resolver or a local DNS filter to refuse answers in private ranges for outbound webhook traffic.
Keep the webhooks feature disabled on multi-user or publicly reachable instances until patched.

bash

# Example egress restriction using iptables to block private destinations
# from the Firefly III container or user context
iptables -A OUTPUT -m owner --uid-owner firefly -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firefly -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firefly -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firefly -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner firefly -d 169.254.0.0/16 -j REJECT