CVE-2026-76239: Stigmem Webhook SSRF Vulnerability

CVE-2026-76239 Overview

CVE-2026-76239 is a Server-Side Request Forgery (SSRF) vulnerability in Stigmem versions prior to 0.9.0a11. The flaw resides in the webhook subscription workflow, where the server fails to validate the delivery_address parameter. Authenticated users can register webhooks that target internal loopback (127.0.0.1) and private network destinations. When matching fact-change events fire, the Stigmem server issues outbound HTTP POST requests to those addresses. This enables blind SSRF against localhost services and adjacent private-network endpoints that would otherwise be unreachable from the internet [CWE-918].

Critical Impact
Authenticated attackers can coerce the Stigmem server into making blind HTTP POST requests to internal services, exposing metadata endpoints and non-public APIs.

Affected Products

Stigmem versions before 0.9.0a11
Stigmem webhook subscription component
Deployments accepting authenticated user-supplied webhook targets

Discovery Timeline

2026-08-19 - CVE-2026-76239 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-76239

Vulnerability Analysis

Stigmem exposes a webhook subscription API that lets authenticated users register callback destinations for fact-change events. The server accepts a delivery_address value and stores it without validating the host, scheme, or destination network. When an event matches a subscription, Stigmem issues a server-side HTTP POST to the stored URL. Because the request originates from the Stigmem process, it inherits the server's network position and can reach services bound to loopback interfaces or internal subnets. The SSRF is blind: attackers cannot directly read response bodies, but they can infer state from timing, error signals, and observable side effects triggered on the target service.

Root Cause

The root cause is missing input validation on the delivery_address parameter during webhook creation. Stigmem does not enforce an allowlist of external destinations, does not block RFC1918 ranges, and does not reject loopback or link-local addresses such as 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.0.0/16. DNS resolution is also not re-checked at request time, which leaves the design open to DNS rebinding in addition to direct IP submission. This maps to CWE-918: Server-Side Request Forgery.

Attack Vector

An attacker with a valid Stigmem account creates a webhook subscription whose delivery_address points at an internal target, for example http://127.0.0.1:8080/admin or a cloud metadata endpoint at http://169.254.169.254/. The attacker then triggers or waits for a matching fact-change event. Stigmem's delivery worker issues an HTTP POST to the internal URL with the event payload as the body. Because POST is used, attackers can also probe internal APIs that accept unauthenticated writes from the loopback interface. Refer to the VulnCheck Advisory on SSRF for additional detail.

Detection Methods for CVE-2026-76239

Indicators of Compromise

Webhook subscription records whose delivery_address resolves to loopback, link-local, or RFC1918 addresses.
Outbound HTTP POST requests from the Stigmem service process to 127.0.0.1, 169.254.169.254, or internal subnets.
Unexpected fact-change event patterns generated by low-privilege accounts shortly after webhook creation.

Detection Strategies

Audit the Stigmem webhook subscription table and flag any delivery_address value pointing to internal networks or non-public hostnames.
Instrument the delivery worker to log the resolved destination IP for every outbound webhook call and alert on private-range hits.
Correlate webhook creation events with subsequent fact-change events from the same account to identify SSRF probing patterns.

Monitoring Recommendations

Enable egress logging on the Stigmem host and forward records to a SIEM for anomaly analysis.
Monitor cloud instance metadata service (IMDS) access logs on hosts running Stigmem.
Track HTTP response codes from webhook deliveries; a surge of 2xx responses from internal IP ranges indicates successful SSRF.

How to Mitigate CVE-2026-76239

Immediate Actions Required

Upgrade Stigmem to version 0.9.0a11 or later on all instances.
Review existing webhook subscriptions and delete any pointing to loopback or private-network destinations.
Rotate credentials or tokens that may have been reachable via SSRF from the Stigmem host, including cloud instance metadata credentials.

Patch Information

The vendor addressed the issue in Stigmem 0.9.0a11, which introduces validation of the delivery_address parameter to reject loopback and private-network destinations. See the GitHub Security Advisory for the full release notes and fix commit references.

Workarounds

Place Stigmem behind an egress proxy that enforces a destination allowlist for webhook traffic.
Apply host firewall rules that block the Stigmem service account from initiating connections to 127.0.0.0/8, RFC1918 ranges, and 169.254.169.254.
Require IMDSv2 with hop-limit 1 on cloud instances hosting Stigmem to prevent metadata credential theft via SSRF.
Restrict webhook creation to trusted operator accounts until the upgrade is completed.

bash

# Example iptables rules restricting Stigmem service egress to internal ranges
iptables -A OUTPUT -m owner --uid-owner stigmem -d 127.0.0.0/8    -j REJECT
iptables -A OUTPUT -m owner --uid-owner stigmem -d 10.0.0.0/8     -j REJECT
iptables -A OUTPUT -m owner --uid-owner stigmem -d 172.16.0.0/12  -j REJECT
iptables -A OUTPUT -m owner --uid-owner stigmem -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner stigmem -d 169.254.0.0/16 -j REJECT