CVE-2026-77067
Description
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
How to fix
- omnivore-app omnivorec4d7d8562e6b9aabb1d8e4dabca268e314baa43a or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| omnivore-app omnivore | v < c4d7d8562e6b9aabb1d8e4dabca268e314baa43a | c4d7d8562e6b9aabb1d8e4dabca268e314baa43a |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.