{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/fider--0.34.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fider:fider:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-65967"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fider (\u003c 0.34.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Fider"],"content_html":"\u003cp\u003eFider versions prior to 0.34.0 contain a Server-Side Request Forgery (SSRF) vulnerability. The application fails to properly validate user-supplied URLs within its webhook configuration feature. An attacker with administrative privileges can supply arbitrary URLs, forcing the Fider server to initiate HTTP requests to restricted internal network resources or cloud provider metadata services (e.g., IMDS). This issue is addressed in Fider version 0.34.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an administrative user to bypass network access controls, potentially leading to unauthorized interaction with internal services or the exfiltration of sensitive cloud instance metadata. This impacts the confidentiality and accessibility of internal network infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpgrade all Fider installations to version 0.34.0 or later immediately. As a compensating control, ensure the Fider server is deployed within a network segment that strictly limits outbound access to only required external endpoints and blocks access to internal network ranges and cloud metadata service IP addresses (e.g., 169.254.169.254).\u003c/p\u003e\n","date_modified":"2026-11-11T20:10:40Z","date_published":"2026-11-11T20:10:40Z","id":"https://feed.craftedsignal.io/briefs/2026-11-fider-ssrf-cve-2026-65967/","summary":"Fider versions before 0.34.0 are vulnerable to Server-Side Request Forgery (SSRF) in the webhook functionality, allowing authenticated administrators to perform unauthorized requests against internal network resources.","title":"Fider: Server-Side Request Forgery via webhook configuration (CVE-2026-65967)","url":"https://feed.craftedsignal.io/briefs/2026-11-fider-ssrf-cve-2026-65967/"}],"language":"en","title":"CraftedSignal Threat Feed - Fider (\u003c 0.34.0)","version":"https://jsonfeed.org/version/1.1"}