CVE-2026-114064: 
Snipe-IT vulnerability analysis and mitigation

CVE-2026-114064 is a Server-Side Request Forgery (SSRF) vulnerability in Snipe-IT's webhook testing feature that allows super-admin users to probe internal network addresses, including loopback (127.0.0.1) and RFC1918 private ranges. It affects all Snipe-IT versions before 8.7.0, developed by Grokability, Inc. The vulnerability was published on October 21, 2026, with the underlying security advisory (GHSA-wqfr-w9hp-c7v6) published by the Snipe-IT maintainer on October 6, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Snipe-IT Advisory).

The root cause is classified as CWE-203 (Observable Discrepancy): Snipe-IT does not restrict webhook destinations to external addresses, permitting requests to any IP including internal network ranges. When a super-admin triggers the "Test Webhooks" function, the server makes an outbound HTTP request to the configured webhook URL. The application returns a 4xx response when a port is open (something is listening) and a 5xx response when the port is closed, creating a timing/response side-channel that enables port scanning and host enumeration. No input validation or SSRF protection is applied to the webhook URL field (Snipe-IT Advisory, GitHub Advisory).

A super-admin attacker can leverage this vulnerability to map internal network topology — identifying active hosts and open ports on networks that would otherwise be inaccessible from their position. This enables internal reconnaissance that could facilitate lateral movement or targeted follow-on attacks against internal services. Confidentiality impact is low (network topology disclosure only), integrity is unaffected, and availability impact is low due to the potential for resource consumption from repeated webhook test requests (Snipe-IT Advisory, GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). Exploitation requires super-admin privileges on the Snipe-IT instance, significantly limiting the attacker pool. The EPSS score is approximately 0.27% (18th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Obtain super-admin access: Authenticate to the Snipe-IT instance with a super-admin account (obtained via credential theft, phishing, or insider access).
2. Navigate to webhook settings: Access the webhook configuration panel within the Snipe-IT admin interface.
3. Configure a target internal address: Set the webhook URL to an internal IP address and port to probe (e.g., http://192.168.1.10:22 or http://127.0.0.1:3306).
4. Trigger the test: Click the "Test Webhooks" button and observe the HTTP response code via the browser's Developer Console.
5. Interpret the response: A 4xx response indicates a service is listening on that port; a 5xx response indicates the port is closed or the host is unreachable.
6. Iterate to map the network: Repeat steps 3–5 with different IP addresses and ports to enumerate active hosts and open services across internal RFC1918 ranges (Snipe-IT Advisory).

• Logs: Snipe-IT application logs showing repeated webhook test events targeting RFC1918 addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.1); web server access logs showing frequent POST requests to the webhook test endpoint from a super-admin session.
• Network: Outbound HTTP/HTTPS connections from the Snipe-IT server to internal IP addresses on non-standard or sequential ports; unusual traffic patterns from the Snipe-IT host to internal subnets it would not normally communicate with.
• Application: Webhook configuration history showing frequent changes to the webhook URL field, particularly to internal IP addresses or hostnames.

Upgrade Snipe-IT to version 8.7.0 or later, which addresses this vulnerability (Snipe-IT Advisory). As interim mitigations: restrict super-admin access to only fully trusted administrators; implement network-level egress filtering on the Snipe-IT server to block outbound connections to RFC1918 and loopback address ranges; and apply network segmentation to limit the Snipe-IT application's access to sensitive internal services.