CVE-2026-24736 Squidex has Server-Side Request Forgery (SSRF) Issue in Webhook Configuration

Critical 9.1 Published 27 Jan 2026 Updated 28 Jan 2026

Attackers can exploit unvalidated webhook URLs to perform Server-Side Request Forgery, accessing internal services and reading responses via logs.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-24736?

CVE-2026-24736 is a critical server-side request forgery vulnerability in squidex, published on 27 Jan 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as actions within the Rules engine. The url parameter in the webhook configuration does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a "Blind" SSRF into a "Full Read" SSRF. As of time of publication, no patched versions are available.

Weakness: CWE-918

Which versions are affected by CVE-2026-24736?

It affects 1 product.

Products include Squidex.io Squidex.

How do I fix CVE-2026-24736?

No fix has been published for CVE-2026-24736 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-24736 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-24736 exists.

Sources

Also known as GHSA-wxg2-953m-fg2w.