CVE-2026-72598 Overview
CVE-2026-72598 is a Server-Side Request Forgery (SSRF) vulnerability in Apioo Fusio version 8.8.3. The flaw resides in the webhook registration endpoint, which validates URL syntax using PHP's FILTER_VALIDATE_URL but enforces no IP or host denylist. Authenticated users holding the consumer role can register webhook URLs that point to internal network addresses. When the associated event fires, the server issues an HTTP POST to the attacker-supplied internal URL, exposing internal services to unauthorized interaction. The weakness is tracked under [CWE-918].
Critical Impact
An authenticated consumer-role user can coerce the Fusio server into making arbitrary HTTP requests to internal network hosts, enabling reconnaissance and interaction with services otherwise unreachable from the internet.
Affected Products
- Apioo Fusio 8.8.3
- Webhook registration component of Fusio API management platform
- Deployments exposing the consumer-role webhook registration endpoint
Discovery Timeline
- 2026-08-11 - CVE-2026-72598 published to the National Vulnerability Database
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72598
Vulnerability Analysis
Fusio is an open-source API management platform written in PHP. It permits consumers to subscribe to events through webhooks, delivering event payloads via outbound HTTP POST requests. The registration endpoint accepts a target URL from the authenticated consumer and stores it for later delivery.
The endpoint validates the submitted URL only against syntactic rules using PHP's FILTER_VALIDATE_URL. This filter confirms that the string is a well-formed URL but performs no resolution or reputation check on the host component. As a result, private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), link-local addresses (169.254.0.0/16), and cloud metadata endpoints such as 169.254.169.254 are accepted without objection.
When the subscribed event triggers, the Fusio worker resolves the stored URL and issues an HTTP POST containing the event payload. The response body and status code can leak back to the attacker through delivery status logs, enabling blind or semi-blind reconnaissance of internal HTTP services.
Root Cause
The root cause is missing egress validation on user-controlled URLs. FILTER_VALIDATE_URL checks only syntax, not destination safety. The webhook subsystem trusts the stored URL at delivery time and does not enforce an allowlist of external destinations or a denylist of internal address ranges.
Attack Vector
An attacker authenticates to Fusio with a consumer-role account, which typically requires minimal privileges and is often self-registration enabled. The attacker registers a webhook subscription with a URL such as http://127.0.0.1:8080/admin or http://169.254.169.254/latest/meta-data/. Triggering the subscribed event causes the Fusio server to issue an outbound POST to that internal target from a trusted network position.
Refer to the Fusio GitHub repository for source-level details of the webhook subsystem.
Detection Methods for CVE-2026-72598
Indicators of Compromise
- Webhook records in the Fusio database whose target URL resolves to RFC1918, loopback, or link-local addresses.
- Outbound HTTP POST requests from the Fusio host to internal IP ranges or cloud metadata endpoints such as 169.254.169.254.
- Consumer-role accounts registering multiple webhook endpoints in rapid succession, often with varied ports.
- Webhook delivery logs showing non-standard internal ports (for example, 6379, 9200, 8500, 2375).
Detection Strategies
- Inspect the fusio_webhook table (or equivalent storage) and flag entries whose host resolves to private or loopback ranges.
- Deploy egress network monitoring on the Fusio server to alert on connections to internal subnets that are not part of expected integrations.
- Correlate consumer account creation events with immediate webhook registrations targeting unusual hostnames.
Monitoring Recommendations
- Forward Fusio application logs and webhook delivery logs to a centralized logging platform for retention and search.
- Alert on any outbound request from Fusio to cloud instance metadata service addresses.
- Baseline expected webhook destinations and generate alerts for deviations.
How to Mitigate CVE-2026-72598
Immediate Actions Required
- Audit existing webhook subscriptions and remove any pointing to internal, loopback, or metadata addresses.
- Restrict consumer-role registration and require administrative approval for new consumer accounts on exposed Fusio deployments.
- Place the Fusio worker in a network segment that cannot reach sensitive internal services or the cloud metadata endpoint.
Patch Information
No vendor patch reference is listed in the NVD entry at the time of publication. Monitor the Fusio GitHub repository for updates addressing the webhook URL validation logic.
Workarounds
- Introduce a reverse proxy or egress firewall that permits Fusio outbound HTTP traffic only to an allowlist of external destinations.
- Block the cloud metadata IP 169.254.169.254 from the Fusio host using host-based firewall rules or IMDSv2 enforcement on AWS.
- Add a custom validation layer that resolves webhook hostnames and rejects submissions targeting private, loopback, or link-local ranges before storage.
# Configuration example: iptables egress rule blocking private ranges from the Fusio host
iptables -A OUTPUT -m owner --uid-owner fusio -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fusio -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fusio -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fusio -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fusio -d 169.254.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
