CVE-2026-27696

HighPublic PoC

Published: 25 February 2026

Published

25 February 2026

Modified

26 February 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS Score 0.0002 6.3th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27696 is a high-severity SSRF (CWE-918) vulnerability in Webtechnologies Changedetection. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly mandates validation of watch URL inputs, including resolved IP addresses, to block private, loopback, or link-local ranges and prevent SSRF exploitation as in the flawed `is_safe_valid_url()` function.

AC-4 Information Flow Enforcement partial match

prevent

Enforces information flow control policies to restrict server-side fetches from the application to internal network resources, mitigating unauthorized access to internal services.

SC-7 Boundary Protection partial match

prevent

Implements boundary protection to monitor and control outbound communications from the application, blocking requests to internal URLs that enable data exfiltration.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1046 Network Service Discovery Discovery

Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

attack.mitre.org →

T1018 Remote System Discovery Discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

attack.mitre.org →

Why these techniques?

SSRF in public-facing web app directly enables T1190 exploitation; allows server-side probing of internal hosts/ports for service and system discovery (T1046, T1018) plus retrieval of internal data.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, changedetection.io is vulnerable to Server-Side Request Forgery (SSRF) because the URL validation function `is_safe_valid_url()` does not validate the resolved IP address of watch URLs…

against private, loopback, or link-local address ranges. An authenticated user (or any user when no password is configured, which is the default) can add a watch for internal network URLs. The application fetches these URLs server-side, stores the response content, and makes it viewable through the web UI — enabling full data exfiltration from internal services. Version 0.54.1 contains a fix for the issue.

Deeper analysisAI

CVE-2026-27696 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) affecting changedetection.io, a free open-source web page change detection tool, in versions prior to 0.54.1. The issue stems from the URL validation function `is_safe_valid_url()`, which fails to check the resolved IP address of watch URLs against private, loopback, or link-local address ranges. This allows the application to process and fetch arbitrary internal URLs without proper restrictions.

An attacker with authenticated access—or any user when no password is configured, which is the default—can exploit this by adding a watch for internal network URLs. The application then fetches these URLs server-side, stores the response content, and exposes it through the web UI, enabling full data exfiltration from internal services. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to network accessibility, low complexity, and significant confidentiality impact in a changed scope.

The GitHub security advisory (GHSA-3c45-4pj5-ch7m) and associated commit (fe7aa38c651d73fe5f41ce09855fa8f97193747b) confirm that version 0.54.1 addresses the issue by improving URL validation to block unsafe IP ranges. Security practitioners should upgrade to 0.54.1 or later and consider enforcing authentication with strong passwords to limit exposure.