CVE-2026-24736

CriticalPublic PoC

Published: 27 January 2026

Published

27 January 2026

Modified

12 February 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0009 25.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24736 is a critical-severity SSRF (CWE-918) vulnerability in Squidex.Io Squidex. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 25.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Data from Local System (T1005) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly requires validation of user-supplied webhook URL parameters to reject local or internal addresses, preventing SSRF exploitation.

AC-4 Information Flow Enforcement good match

prevent

Enforces approved information flows to block backend HTTP requests to unauthorized internal or local destinations specified in webhook configurations.

SC-7 Boundary Protection partial match

preventdetect

Monitors and controls communications at internal interfaces to limit SSRF requests from the backend to internal services and detect anomalous traffic.

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

T1082 System Information Discovery Discovery

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF in public-facing app directly enables internal/local HTTP requests + response retrieval (T1005 Data from Local System, T1046 Network Service Discovery, T1082 System Information Discovery) and constitutes exploitation of a public-facing application (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Squidex is an open source headless content management system and content management hub. Versions of the application up to and including 7.21.0 allow users to define "Webhooks" as actions within the Rules engine. The url parameter in the webhook configuration…

does not appear to validate or restrict destination IP addresses. It accepts local addresses such as 127.0.0.1 or localhost. When a rule is triggered (Either manual trigger by manually calling the trigger endpoint or by a content update or any other triggers), the backend server executes an HTTP request to the user-supplied URL. Crucially, the server logs the full HTTP response in the rule execution log (lastDump field), which is accessible via the API. Which turns a "Blind" SSRF into a "Full Read" SSRF. As of time of publication, no patched versions are available.

Deeper analysisAI

CVE-2026-24736 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting Squidex, an open source headless content management system and content management hub. Versions up to and including 7.21.0 are vulnerable due to inadequate validation of the URL parameter in webhook configurations within the Rules engine. This parameter accepts local addresses such as 127.0.0.1 or localhost without restricting destination IP addresses.

High-privileged users (PR:H per CVSS 3.1 score of 9.1, AV:N/AC:L/UI:N/S:C/C:H/I:H/A:H) can exploit this by defining a webhook with a local or internal URL. When the rule triggers—through manual endpoint calls, content updates, or other events—the backend server issues an HTTP request to the supplied URL and logs the full HTTP response in the rule execution log's lastDump field, which is accessible via the API. This transforms a blind SSRF into a full read SSRF, enabling attackers to retrieve responses from internal services.

The GitHub security advisory (GHSA-wxg2-953m-fg2w) provides further details, but as of the CVE publication on 2026-01-27T21:16:02.967, no patched versions are available. Security practitioners should monitor for updates and consider restricting webhook configurations or rule triggers in affected deployments.