CVE-2026-22247: 
GLPI vulnerability analysis and mitigation

CVE-2026-22247 is a Server-Side Request Forgery (SSRF) vulnerability in GLPI, a free asset and IT management software package. It affects GLPI versions 11.0.0 through 11.0.4, allowing an authenticated administrator to perform arbitrary SSRF requests via the Webhook feature. The vulnerability was published on February 4, 2026, and patched in version 11.0.5. The GitHub Security Advisory assigns a CVSS v3.1 score of 4.1 (Moderate), while NVD records a higher score of 9.1 (Critical) — the discrepancy reflects differing assessments of impact scope (GitHub Advisory, GLPI Release).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where the GLPI web server can be induced to make arbitrary outbound network requests initiated by an authenticated administrator through the Webhook configuration feature. An attacker with administrator-level access can configure a Webhook to point to internal or otherwise restricted network endpoints, causing the GLPI server to issue HTTP requests on their behalf. This allows probing of internal services, metadata endpoints (e.g., cloud instance metadata), or other resources reachable from the GLPI server that would not normally be accessible to the attacker directly. No public proof-of-concept exploit code has been identified (GitHub Advisory, Feedly).

Successful exploitation allows an administrator-level attacker to pivot the GLPI server into an internal network proxy, potentially exposing sensitive internal services, cloud metadata APIs, or other resources not directly accessible from the attacker's network. The primary impact is on confidentiality — internal network topology can be mapped and sensitive data from reachable systems may be retrieved. Integrity and availability of the GLPI instance itself are not directly impacted by this vulnerability (GitHub Advisory, Feedly).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time. The vulnerability requires high privileges (administrator access) to exploit, which significantly limits the attack surface. The EPSS score is approximately 0.023%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Gain Administrator Access: Obtain GLPI administrator credentials through phishing, credential stuffing, or insider access — exploitation requires high-privilege authentication.
2. Navigate to Webhook Configuration: Log into the GLPI admin panel and locate the Webhook feature under the administration or notification settings.
3. Configure Malicious Webhook URL: Create or modify a Webhook entry, setting the target URL to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://internal-service:8080/api/) that would not normally be accessible externally.
4. Trigger the Webhook: Initiate an action in GLPI that causes the configured Webhook to fire, prompting the GLPI server to issue an HTTP request to the attacker-controlled internal URL.
5. Retrieve Response Data: Observe the Webhook response or error logs within GLPI to extract data returned from the internal endpoint, enabling reconnaissance of internal services or retrieval of sensitive information (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the GLPI server to internal IP ranges (RFC 1918 addresses), cloud metadata endpoints (e.g., 169.254.169.254), or unusual external hosts not associated with normal GLPI operations.
• Logs: GLPI application logs showing Webhook delivery attempts to internal or non-standard URLs; web server access logs recording outbound connections initiated by the GLPI process to internal network resources.
• Application: New or recently modified Webhook configurations in the GLPI admin panel pointing to internal or unexpected URLs; audit log entries showing administrator-level changes to Webhook settings.

The primary remediation is to upgrade GLPI to version 11.0.5 or later, which contains the fix for this vulnerability (GLPI Release). As interim mitigations, organizations should restrict GLPI administrator account access to only trusted personnel, implement network egress filtering to prevent the GLPI server from making outbound requests to internal network ranges, and disable the Webhook feature entirely if it is not required for operations. Monitoring administrator activity — particularly Webhook configuration changes — is also recommended (Feedly).

The vulnerability was reported by researcher jpgjpgjpgjpg and disclosed via GitHub Security Advisories by GLPI maintainer cedric-anne on February 4, 2026. The GLPI project forum acknowledged the release of version 11.0.5 as a security release and recommended upgrading. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory, GLPI Forum).