Strapi webhook runner SSRF via redirect disclosed as CVE-2026-118172

CVE-2026-118172 in Strapi's Core Admin Webhook Runner lets a webhook follow a redirect past the original URL validation, enabling semi-blind SSRF against internal services. The flaw is fixed in 2.8.2, and admins are advised to audit delivery logs and restrict webhook egress.

• CVE-2026-118172 affects the Core Admin Webhook Runner in Strapi
• A redirect bypasses the initial URL check and reaches internal hosts
• Semi-blind SSRF leaks status codes, timing and errors
• The issue is fixed in Strapi 2.8.2