Medium severity · published Sep 29, 2026
CVE-2026-102877
Fider before 0.38.0 SSRF via DNS rebinding in webhook validation
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
fider · getfider
before 0.38.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102877
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102877
vendor-advisory
https://github.com/getfider/fider/security/advisories/GHSA-whx4-hxwq-qgjh
patch
https://github.com/getfider/fider/commit/45f5627b9fd15b912fb9092635c863fb4c91dd69
technical-description
https://github.com/getfider/fider/blob/v0.37.0/app/pkg/validate/general.go
technical-description
https://github.com/getfider/fider/blob/v0.37.0/app/services/httpclient/httpclient.go
release-notes
https://github.com/getfider/fider/releases/tag/v0.38.0
product
https://github.com/getfider/fider