SSRF in Pinpoint-Apm Pinpoint
CVE-2026-57947
Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (23.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 23.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Pinpoint-Apm Pinpoint — versions 0
Weakness classification (CWE)
References
- github.com/pinpoint-apm/pinpoint/issues/13857 (issue-tracking)
- www.vulncheck.com/advisories/pinpoint-server-side-request-forgery-via-alarm-web… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-57947?
- CVE-2026-57947 is a high-severity vulnerability in Pinpoint-Apm Pinpoint, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.5/10. Published 2026-06-29.
- How severe is CVE-2026-57947?
- High severity. CVSS v3 base score is 8.5 out of 10.