CVE-2026-57947: Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-10-25
Weakness: CWE-918

Description

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Affected products

pinpoint-apm pinpoint: through 3.1.0

References

https://github.com/pinpoint-apm/pinpoint/issues/13857
https://www.vulncheck.com/advisories/pinpoint-server-side-request-forgery-via-alarm-webhook-registration

Get alerted when CVE-2026-57947 or the next vulnerability affects your stack