Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Fider can be tricked to contact internal services

CVE-2026-102877 · published 19 days ago
Summary

If you run Fider version earlier than 0.38.0, an attacker who can control DNS could make the Fider server send requests to your internal systems or cloud metadata services when it processes webhooks or custom login links. This could expose sensitive internal data. Upgrade Fider to version 0.38.0 or newer, and limit DNS changes for the server, to stop the issue.

What to do
  • Update getfider fider to version 0.38.0 or later.
Affected software
VendorProductAffected versions
getfider fider < 0.38.0
Original advisory text
Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published29 Sep 2026
Updated19 Oct 2026
First seen29 Sep 2026
Sources
CVE-2026-102877 · NVD
CVE-2026-102877 · MITRE
CVE-2026-102877 · OSV
GHSA-whx4-hxwq-qgjh · GHSA
Track software like this
Free during beta