CVE-2026-82262: Logto lets admin trigger internal network requests

In Logto versions up to 1.42.0, the test webhook endpoint accepts any web address without checking it, so an administrator who has a management token can cause the Logto server to send its own HTTP requests to internal systems and see the replies. This could expose information from services that are meant to be private. Upgrade to a version that removes the flaw, limit who has management tokens, and consider blocking outbound traffic from the Logto server to internal-only addresses.

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

• https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed2... Patch
• https://github.com/logto-io/logto Product
• https://github.com/logto-io/logto/blob/v1.42.0/packages/core/src/libraries/hook/... Third Party Advisory
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82262... Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-82262 Vendor Advisory
• https://github.com/logto-io/logto/issues/9465 Third Party Advisory
• https://www.vulncheck.com/advisories/logto-server-side-request-forgery-via-webho... Vendor Advisory