CVE-2026-8725 - CoreWorxLab CAAL SSRF Vulnerability

CVE-2026-8725 is a server-side request forgery (SSRF) vulnerability affecting CoreWorxLab CAAL (version 1.6.0 and earlier). The vulnerability is located in the src/caal/webhooks.py file within the test-hass Endpoint component. An attacker can manipulate an unknown function to cause the server to make unintended HTTP requests to internal or external resources. Publicly available exploit code exists, increasing the risk of exploitation. The vendor, CoreWorxLab, was notified but did not respond. This vulnerability allows a remote, unauthenticated attacker to potentially access sensitive internal resources or trigger other actions on the internal network.

Attack Chain

1. The attacker identifies a vulnerable CoreWorxLab CAAL instance running version 1.6.0 or earlier.
2. The attacker crafts a malicious HTTP request targeting the test-hass endpoint.
3. The crafted request includes a payload designed to manipulate the src/caal/webhooks.py file’s vulnerable function.
4. The manipulated function constructs an HTTP request based on attacker-controlled parameters.
5. The CAAL server sends the crafted HTTP request to an internal or external resource.
6. The attacker observes the response from the targeted resource, gaining unauthorized access to internal information or services.
7. The attacker may use the SSRF vulnerability to scan internal networks, enumerate services, and identify further attack vectors.

Impact

Successful exploitation of CVE-2026-8725 enables attackers to perform unauthorized actions on the vulnerable server’s internal network. This could lead to the disclosure of sensitive information, the compromise of internal services, or further exploitation of other vulnerabilities within the network. Since a public exploit exists, unpatched instances are at high risk of compromise.

Recommendation

• Upgrade CoreWorxLab CAAL to a version beyond 1.6.0 that addresses CVE-2026-8725.
• Deploy the Sigma rule Detect CVE-2026-8725 SSRF Attempt via Webhooks to detect suspicious requests targeting the vulnerable endpoint.
• Monitor web server logs for unusual outbound connections originating from the CAAL server, which could indicate SSRF activity.