CVE-2026-71626 Overview
CVE-2026-71626 is a Server-Side Request Forgery (SSRF) vulnerability in Invoice Ninja v5.13.24. The flaw resides in the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php webhook API components. A remote unauthenticated attacker can abuse these endpoints to force the application to issue requests to internal or loopback addresses. The result is disclosure of sensitive information that would otherwise be inaccessible from outside the network perimeter. The vulnerability is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).
Critical Impact
Attackers can pivot through Invoice Ninja webhooks to reach internal services, cloud metadata endpoints, and loopback interfaces, exposing sensitive data.
Affected Products
- Invoice Ninja v5.13.24
- Invoice Ninja v5 webhook API (StoreWebhookRequest.php, UpdateWebhookRequest.php, WebhookSingle.php)
- Deployments exposing the Invoice Ninja API to untrusted networks
Discovery Timeline
- 2026-09-04 - CVE-2026-71626 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-71626
Vulnerability Analysis
Invoice Ninja allows users to configure webhooks that trigger outbound HTTP requests when specific events occur. The webhook request handlers accept a user-supplied target URL without validating the destination. An attacker can register or update a webhook pointing to http://127.0.0.1, http://localhost, or private RFC1918 addresses. When the webhook fires or is manually invoked through WebhookSingle.php, the Invoice Ninja server issues an HTTP request from its own network position. Responses returned to the attacker can expose internal service banners, administrative dashboards, and cloud metadata service responses containing credentials.
Root Cause
The root cause is missing destination validation in the webhook creation and update request classes. StoreWebhookRequest.php and UpdateWebhookRequest.php fail to restrict URLs to public, routable addresses. WebhookSingle.php then dispatches the outbound request without applying an allowlist, DNS resolution check, or IP range filter. This maps to [CWE-200] because the returned data reaches an unauthorized actor.
Attack Vector
The vulnerability is exploitable over the network with no privileges and no user interaction. An attacker submits a webhook configuration referencing an internal target such as http://169.254.169.254/latest/meta-data/ on cloud deployments. Triggering the webhook causes the server to fetch and return the internal response. See the CVE-2026-71626 API Webhook SSRF Analysis for the full technical walkthrough.
No verified proof-of-concept code is available at this time. Refer to the linked advisory for request structure and reproduction steps.
Detection Methods for CVE-2026-71626
Indicators of Compromise
- Webhook configurations in the Invoice Ninja database referencing 127.0.0.1, localhost, 169.254.169.254, or RFC1918 ranges
- Outbound HTTP requests from the Invoice Ninja host to internal-only IP addresses
- Unexpected access log entries on internal services originating from the Invoice Ninja server
- API calls to /api/v1/webhooks from unauthenticated or newly created accounts
Detection Strategies
- Inspect webhook records for URLs resolving to non-public IP address ranges
- Correlate webhook creation events with subsequent outbound traffic from the application host
- Alert on requests from the Invoice Ninja server to cloud metadata endpoints such as 169.254.169.254
- Monitor HTTP response sizes returned to webhook subscribers for anomalous internal service payloads
Monitoring Recommendations
- Enable verbose logging on the Invoice Ninja webhook subsystem including target URLs and response codes
- Forward web server and application logs to a centralized analytics platform for correlation
- Deploy egress firewall logging to record every outbound request initiated by the Invoice Ninja process
- Review new webhook registrations on a scheduled basis for anomalous destinations
How to Mitigate CVE-2026-71626
Immediate Actions Required
- Restrict access to the Invoice Ninja API from untrusted networks using firewall or reverse proxy rules
- Audit existing webhook configurations and remove entries targeting internal or loopback addresses
- Block outbound traffic from the Invoice Ninja host to internal management ranges and cloud metadata endpoints
- Disable the webhook feature until a vendor patch is available if webhooks are not in active use
Patch Information
No vendor patch is referenced in the current CVE record for Invoice Ninja v5.13.24. Monitor the Invoice Ninja v5 repository for a fixed release addressing SSRF in StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php. Apply upstream updates immediately upon publication.
Workarounds
- Enforce an egress allowlist that permits webhook traffic only to known third-party integration endpoints
- Route webhook traffic through a validating outbound HTTP proxy that rejects private and loopback destinations
- Require IMDSv2 on AWS deployments to raise the bar for cloud metadata service abuse
- Deploy DNS filtering to block resolution of internal hostnames from the application host
# Configuration example: nftables egress restriction for the Invoice Ninja host
nft add rule inet filter output ip daddr 127.0.0.0/8 drop
nft add rule inet filter output ip daddr 10.0.0.0/8 drop
nft add rule inet filter output ip daddr 172.16.0.0/12 drop
nft add rule inet filter output ip daddr 192.168.0.0/16 drop
nft add rule inet filter output ip daddr 169.254.0.0/16 drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
