oss-sec mailing list archives

CVE-2026-80181: Apache Allura: Server-side request forgery

From: Dave Brondsema <dave () brondsema net>
Date: Thu, 3 Sep 2026 13:34:22 -0400

Severity: important

Affected versions:

- Apache Allura through 1.20.0

Description:

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).

This issue affects Apache Allura: through 1.20.0.

Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Credit:

n0mi1k (reporter)

References:

https://allura.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-80181

Current thread:

CVE-2026-80181: Apache Allura: Server-side request forgery Dave Brondsema (Sep 03)