CVE-2026-57947

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57947
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57947.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57947
Published
2026-06-29T17:18:50.802Z
Modified
2026-07-16T03:30:54.015718547Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N CVSS Calculator
Summary
Pinpoint - Server-Side Request Forgery via Alarm Webhook Registration
Details

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Database specific 
{
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57947.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/pinpoint-apm/pinpoint

Affected ranges

Type
GIT
Repo
https://github.com/pinpoint-apm/pinpoint
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e3940e516c0fc215be990778a6eca01e2274870a
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.1.0"
        },
        {
            "fixed": "3.1.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*
1.5.1
1.5.2
1.6.0
1.6.0-RC1
1.6.0-RC2
1.6.1
1.6.1-RC1
1.6.1-RC2
1.7.0
1.7.0-RC1
1.7.0-RC2
1.7.1
1.7.2
1.8.0
1.8.0-RC1
1.8.1
1.8.1-RC1
v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.4.0
v2.4.0-RC1
v2.5.0
v2.5.1
v3.*
v3.0.0
v3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57947.json"