CVE-2026-24736: SSRF in Squidex Headless CMS

The SSRF vulnerability in Squidex arises from insufficient validation of the URL parameter within webhook configurations. Attackers can craft malicious rules that trigger HTTP requests to internal resources, bypassing network segmentation and potentially accessing sensitive data. This could include accessing internal APIs, databases, or other services that are not directly exposed to the internet. Successful exploitation could lead to data breaches, privilege escalation, or even complete system compromise. The ability to target localhost (127.0.0.1) directly increases the attack surface significantly, as it allows attackers to interact with services running on the same server.

1. Reserved2026-01-26
2. Published2026-01-27
3. Modified2026-01-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-24736 is to upgrade Squidex to version 7.21.1 or later, which includes the necessary URL validation fixes. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict network access to the Squidex server to only necessary ports and IP addresses. Implement a Web Application Firewall (WAF) with rules to block outbound requests to suspicious internal addresses. Carefully review all webhook configurations and disable any that are not absolutely essential. Monitor Squidex logs for unusual outbound HTTP requests.