CVE-2026-92602: TDuck Survey Form Auth Bypass Vulnerability

CVE-2026-92602 Overview

CVE-2026-92602 is a Server-Side Request Forgery (SSRF) vulnerability in TDuck survey form through version 5.3. The WebhookConfigController fails to validate webhook URLs and does not verify form ownership before attaching webhooks. Authenticated attackers can attach webhooks to forms owned by other users and redirect form submissions to arbitrary external or internal endpoints. This enables data exfiltration of survey submissions and probing of internal network resources reachable from the TDuck server.

Critical Impact
Authenticated users can exfiltrate other users' survey submissions and reach internal-only network services through the TDuck backend.

Affected Products

TDuck survey form versions up to and including 5.3
The tduck-webhook module (WebhookConfigController, WebhookSenderService)
Deployments exposing the TDuck webhook configuration API to authenticated users

Discovery Timeline

2026-09-16 - CVE-2026-92602 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92602

Vulnerability Analysis

The flaw resides in the tduck-webhook module, specifically in WebhookConfigController which accepts webhook configuration requests without validating two critical properties. First, the controller does not verify that the destination URL is safe or restricted to allowed hosts. Second, it does not confirm that the requesting user owns the target form. The WebhookSenderService subsequently issues HTTP requests to the attacker-supplied URL whenever a submission is received. This turns the application into a request proxy under attacker control, categorized as [CWE-918] Server-Side Request Forgery.

Root Cause

Two missing checks combine to produce the vulnerability. The controller accepts any URL string as a webhook target without allowlist enforcement, scheme filtering, or address resolution against private ranges. It also lacks an authorization check binding the form identifier in the request to the authenticated user's owned forms. Together these gaps produce both broken access control and SSRF in the same code path.

Attack Vector

An authenticated attacker sends a webhook configuration request referencing another user's form identifier and a URL pointing to an attacker-controlled server or an internal address such as http://127.0.0.1:8080 or a cloud metadata endpoint. When a legitimate respondent submits the targeted form, the TDuck server sends the submission payload to the attacker's URL. The attacker receives sensitive form data and can also enumerate internal services by observing response timing and error behavior. See the VulnCheck SSRF Advisory and the affected code in the GitHub Webhook Config Code and GitHub Webhook Sender Code references. No verified proof-of-concept code is published; refer to the advisory for exploitation details.

Detection Methods for CVE-2026-92602

Indicators of Compromise

Webhook configurations pointing to loopback, RFC1918, link-local, or cloud metadata addresses such as 169.254.169.254
Webhook targets on domains unrelated to the form owner's organization
Webhook records whose creating user identifier does not match the owning user of the referenced form
Outbound HTTP requests from the TDuck application host to unexpected internal services shortly after form submissions

Detection Strategies

Query the webhook configuration table and flag rows where create_user differs from the form's owner
Parse stored webhook URLs and alert on private address ranges, non-HTTPS schemes, or newly registered domains
Correlate application logs from WebhookSenderService with egress proxy logs to identify anomalous destinations

Monitoring Recommendations

Enable egress logging on the TDuck server and alert on connections to internal subnets or metadata endpoints
Audit all POST requests to the webhook configuration endpoint and record the authenticated user, form ID, and target URL
Review webhook activity after any privilege change or new user registration in the TDuck tenant

How to Mitigate CVE-2026-92602

Immediate Actions Required

Restrict access to the TDuck webhook configuration API to trusted administrators until a patch is applied
Audit existing webhook configurations and remove entries with untrusted or internal destination URLs
Place the TDuck server behind an egress proxy that blocks requests to private and metadata address ranges

Patch Information

No fixed version is identified in the NVD entry at the time of publication. Monitor the GitHub Project Repository and GitHub Issue #40 for upstream fixes that add URL allowlisting and form ownership checks in WebhookConfigController.

Workarounds

Enforce a network egress policy that denies TDuck server traffic to RFC1918, loopback, and 169.254.0.0/16 ranges
Add a reverse proxy rule that requires webhook destinations to match an approved domain allowlist
Disable the webhook feature in deployments that do not require outbound submission forwarding

bash

# Example egress restriction using iptables on the TDuck host
iptables -A OUTPUT -m owner --uid-owner tduck -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner tduck -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner tduck -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner tduck -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner tduck -d 169.254.0.0/16 -j REJECT