CVE-2026-102877GHSA-whx4-hxwq-qgjh
Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
getfider fider
CVSS
2.1LowExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 30 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.38.0fiderCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
Text from CVE List
Affected versions 2
- fideraffected: all versions before 0.38.0CVE List
- fiderunaffected: 0.38.0CVE List
References 7
- github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69Fixvia CVE List
- github.com/getfider/fider/releases/tag/v0.38.0Fixvia CVE List
- github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjhAdvisoryvia CVE List
- vulncheck.com/advisories/fider-before-0.38.0-ssrf-via-dns-rebinding-in-webhook-validationAdvisoryvia CVE List
- github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.goReferencevia CVE List
- github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.goReferencevia CVE List
- github.com/getfider/fiderReferencevia CVE List