CVE-2026-77351: Wallos Personal Subscription Tracker SSRF

CVE-2026-77351 Overview

CVE-2026-77351 is a Server-Side Request Forgery (SSRF) vulnerability in Wallos, an open-source self-hostable personal subscription tracker. Versions prior to 5.0.0 allow any authenticated user to store an arbitrary SMTP host in their personal email notification settings without server-side validation. When the scheduled notification cron job executes, Wallos passes the attacker-controlled host directly to PHPMailer. The server then opens outbound TCP connections to whatever address the attacker specified, including private IP ranges and cloud metadata endpoints. The issue is tracked as CWE-918 and fixed in version 5.0.0.

Critical Impact
Low-privileged authenticated users can probe internal network services and cloud metadata endpoints from the Wallos server's network perspective.

Affected Products

Wallos subscription tracker versions prior to 5.0.0
Self-hosted Wallos deployments with email notifications configured
Docker-based Wallos installations with network access to internal resources

Discovery Timeline

2026-08-31 - CVE-2026-77351 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-77351

Vulnerability Analysis

The vulnerability resides in the email notification settings workflow. Wallos accepts a user-supplied SMTP host string and persists it to the per-user configuration. No allowlist, blocklist, or DNS resolution check filters private, loopback, or link-local addresses. A scheduled cron job later reads the stored value and hands it to PHPMailer's SMTP client.

Because PHPMailer performs a raw TCP connection to the configured host and port, the attacker controls the destination of an outbound request originating from the Wallos server. The attacker can target internal-only services on RFC1918 ranges, container networks, or cloud metadata services such as 169.254.169.254.

While SMTP is not HTTP, the connection behavior alone is sufficient for network reconnaissance. Response timing, connection success, and TLS handshake errors leak the presence and state of internal services.

Root Cause

The root cause is missing server-side validation of the SMTP host field before it is consumed by the mail delivery routine. The application trusts authenticated user input for a security-sensitive network destination. Standard SSRF protections such as IP address resolution, private-range rejection, and metadata endpoint blocking are absent.

Attack Vector

An authenticated attacker with any user role updates their notification settings to point the SMTP host at an internal target. The attacker waits for the notification cron job or triggers a test send if available. The Wallos server then initiates a TCP connection to the specified host and port, revealing service availability through observable side effects.

See the GitHub Security Advisory GHSA-mwqv-gv8x-9jcp for full advisory details. The fix landed in the Wallos v5.0.0 release via this commit.

Detection Methods for CVE-2026-77351

Indicators of Compromise

Outbound TCP connections from the Wallos server or container to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254
SMTP host values in the Wallos database containing internal IPs, cloud metadata hostnames, or non-standard ports
PHPMailer connection errors in Wallos logs referencing unexpected hosts or ports
Notification cron job entries producing outbound connections to hosts not associated with legitimate mail providers

Detection Strategies

Audit the Wallos user notification settings table for SMTP host values outside an approved provider list
Monitor egress from the Wallos host with network flow logs and alert on connections to internal ranges from the application process
Enable PHP and PHPMailer error logging to capture failed connection attempts that reveal SSRF probing

Monitoring Recommendations

Forward Wallos application logs and host network telemetry to a centralized log platform for correlation
Baseline expected SMTP destinations and alert on deviations from that baseline
Track authenticated changes to notification settings and correlate with subsequent outbound connections

How to Mitigate CVE-2026-77351

Immediate Actions Required

Upgrade Wallos to version 5.0.0 or later, which contains the patched validation logic
Review all user-configured SMTP host values and reset any that reference internal or metadata addresses
Restrict egress from the Wallos server using host or network firewalls to only approved SMTP endpoints

Patch Information

The fix is available in the Wallos v5.0.0 release. The patch is delivered through the commit at ellite/Wallos@11eaf40. Full advisory context is available in GHSA-mwqv-gv8x-9jcp.

Workarounds

Block outbound connections from the Wallos container or host to RFC1918, loopback, and link-local ranges including 169.254.169.254
Disable email notifications until the upgrade is applied if patching is delayed
Restrict Wallos user account creation and require administrator approval to reduce the pool of attackers

bash

# Example iptables egress restriction for a Wallos container host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j DROP