CVE-2026-92527: Chatwoot Shopify OAuth SSRF Vulnerability

CVE-2026-92527 Overview

CVE-2026-92527 is a Server-Side Request Forgery (SSRF) vulnerability affecting Chatwoot versions up to and including 4.17.1. The flaw resides in an unspecified function within the callbacks_controller.rb file, part of the Shopify OAuth integration component. An authenticated remote attacker can manipulate request parameters to coerce the Chatwoot server into issuing outbound HTTP requests to attacker-controlled or internal destinations. The exploit details have been publicly disclosed. According to the advisory, the project maintainers were notified through an issue report but had not yet responded at the time of publication.

Critical Impact
Authenticated attackers can abuse the Shopify OAuth callback handler to send server-originated requests to internal network resources, potentially exposing metadata endpoints, internal services, or supporting further attacks on the hosting environment.

Affected Products

Chatwoot versions up to 4.17.1
Chatwoot Shopify OAuth component (callbacks_controller.rb)
Self-hosted Chatwoot deployments exposing the OAuth callback endpoint

Discovery Timeline

2026-09-16 - CVE-2026-92527 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92527

Vulnerability Analysis

CVE-2026-92527 is classified under CWE-918: Server-Side Request Forgery (SSRF). The vulnerable code path lives inside the Shopify OAuth callbacks_controller.rb handler, which processes callback data during the OAuth authorization exchange with Shopify. Because a user-controllable value influences the destination of an outbound HTTP request made by the Chatwoot backend, an attacker can direct that request to arbitrary hosts.

Exploitation requires network reachability to the Chatwoot instance and low-privileged authenticated access. The attacker does not need to interact with a user. Successful abuse allows the server to fetch resources from internal-only endpoints, cloud instance metadata services, or other services trusted by the Chatwoot host, with limited confidentiality, integrity, and availability impact per the advisory.

Root Cause

The root cause is inadequate validation of a URL or host parameter used within the Shopify OAuth callback flow. The controller passes attacker-influenced input into an HTTP client without enforcing an allowlist of Shopify domains, blocking private IP ranges, or restricting the URL scheme. This trust in externally supplied callback data enables the server to be used as a request proxy.

Attack Vector

The attack vector is network-based. An authenticated attacker crafts a Shopify OAuth callback request to the Chatwoot instance with a manipulated parameter that causes the backend to issue an HTTP request to a target of the attacker's choosing. Because the request originates from the Chatwoot server, it can reach resources not accessible from the attacker's own network position, including link-local metadata endpoints such as 169.254.169.254 on cloud deployments.

No verified exploit code is published in the referenced advisories. See the GitHub Security Advisory GHSA-wxhm-4rjw-9m7v and Chatwoot Issue #14887 for technical context.

Detection Methods for CVE-2026-92527

Indicators of Compromise

Outbound HTTP requests from the Chatwoot application server to internal IP ranges (RFC 1918) or cloud metadata endpoints such as 169.254.169.254.
Unusual request activity to the Shopify OAuth callback route in callbacks_controller.rb originating from a single authenticated account.
Chatwoot application logs showing OAuth callback parameters containing URLs, IP literals, or non-Shopify hostnames.

Detection Strategies

Inspect web server and reverse proxy logs for requests targeting the Shopify OAuth callback path with anomalous query parameters or Host values.
Correlate egress traffic from the Chatwoot backend against an allowlist of expected Shopify domains and alert on deviations.
Monitor cloud provider metadata service access from workloads hosting Chatwoot; legitimate application flows should not touch these endpoints.

Monitoring Recommendations

Enable verbose logging on the Rails application layer for OAuth callback handlers to capture full parameter payloads for forensic review.
Forward Chatwoot application, proxy, and cloud audit logs to a centralized analytics platform for cross-source correlation.
Alert on unexpected outbound DNS resolutions from the Chatwoot host to non-Shopify domains during OAuth flows.

How to Mitigate CVE-2026-92527

Immediate Actions Required

Restrict access to the Chatwoot administrative and OAuth callback endpoints to trusted networks until a patched release is available.
Disable or remove the Shopify integration on affected Chatwoot instances if it is not actively used.
Audit recent OAuth callback traffic and outbound requests from the Chatwoot server for signs of SSRF probing.

Patch Information

At the time of publication, no vendor patch is referenced for Chatwoot 4.17.1 or earlier. Track the Chatwoot Repository and GitHub Security Advisory GHSA-wxhm-4rjw-9m7v for a fixed release, and upgrade as soon as a corrected version is published.

Workarounds

Enforce egress filtering on the Chatwoot host to block outbound traffic to RFC 1918 ranges, loopback, and cloud metadata endpoints such as 169.254.169.254.
Require Instance Metadata Service v2 (IMDSv2) on AWS-hosted deployments to prevent SSRF against the metadata service.
Place the Chatwoot application behind a proxy that validates and rewrites outbound HTTP requests to enforce a Shopify domain allowlist.
Limit which user roles can configure Shopify integrations to reduce the population of accounts that can reach the vulnerable code path.

bash

# Configuration example: block SSRF-relevant egress destinations from the Chatwoot host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT