Skip to content

Back to the catalog

Dark Web Informer (@DarkWebInformer) on X
x.comthread

Dark Web Informer (@DarkWebInformer) on X

Social post from DarkWebInformer announcing a released proof-of-concept for CVE-2026-82957, a server-side request forgery in Hyperledger FireFly. The flaw lies in webhook subscriptions, where a user-controlled webhook URL is accepted without validating the destination host. The PoC is hosted in a hakaioffsec GitHub repo.

TL;DR PoC released for Hyperledger FireFly webhook-subscription SSRF (CVE-2026-82957) due to unvalidated destination host.
Open original ↗

Organisations named here

  • CWE-918
  • hakaioffsec

CVEs named here

  • CVE-2026-82957

Technologies named here

  • Hyperledger FireFly
  • PoC exploit for CVE-2026-82957
  • GitHub

Techniques named here

  • SSRF

Related in AppSec