UpHeron
All vulnerabilities

Servers and applications

GHSA-cq5q-r4h3-c83v

SSRF: Custom notification endpoint takes arbitrary URL + headers — no URL/host validation

Severity
High 8.1
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
0.31.1
Weakness
Improper input validation (CWE-20)Server-side request forgery (CWE-918)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read data · Change data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Sources
Project advisories (GitHub)

Description

github.com/Dokploy/dokploy (master, current as of 2026-05-26)

Berkan SAL (@Uhudsavasindankacanokcu2) — [email protected]

Dokploy lets an org admin create twelve types of outbound notifications. One of them — Custom — takes an arbitrary endpoint URL AND an arbitrary header map AND delivers the notification payload as a POST body. The Zod schema for this provider is:

The dispatcher is sendCustomNotification():

There is no SSRF guard anywhere in the chain — no loopback / private-IP / link-local / IPv6-ULA blocklist, no DNS-resolution pin, no scheme restriction. The string "http://127.0.0.1:6379/" is a valid endpoint. Same for "http://[::1]:8200/v1/secret/data/prod" with headers = { "X-Vault-Token": "…" }.

The same gap exists in all twelve providers (Slack, Telegram, Discord, Email, Resend, Gotify, Ntfy, Mattermost, Custom, Lark, Teams, Pushover) — eleven of them gate on z.string().min(1) or z.string().url() only — but Custom is the most powerful one because the attacker also…

From Dokploy/dokploy's security advisory. Shortened; the full text is there.

Affected software

SoftwareAffected versions
DokployServers and applications · github:dokploy/dokploy
  • Every version before 0.31.1

References