SSRF in Pinpoint-Apm Pinpoint
CVE-2026-57947
Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.002 (15.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N.
Affected products
- Pinpoint-apm Pinpoint — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-57947?
- CVE-2026-57947 is a high-severity vulnerability in Pinpoint-Apm Pinpoint, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.5/10. Published 2026-06-29.
- How severe is CVE-2026-57947?
- High severity. CVSS v3 base score is 8.5 out of 10.