CVE-2026-80181

Apache Allura, an open-source project forge platform, contains a server-side request forgery (SSRF) flaw (CWE-918) in its webhooks feature, affecting all versions through 1.20.0. The vulnerable webhook handling lets the Allura server be induced to issue requests to attacker-chosen URLs, and per the CVSS vector the issue is exploitable over a network without privileges or user interaction. A successful attacker gains the ability to probe or reach internal network services from the server's perspective (e.g., internal-only endpoints or cloud instance metadata), with the CVSS vector rating high impact on confidentiality and integrity and no availability impact. Anyone running an affected Allura deployment up to and including 1.20.0 is exposed, particularly if the webhooks feature is in use or reachable. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at roughly 0.4%, indicating no confirmed exploitation in the wild.

What to do: Upgrade Apache Allura to version 1.21.0, which fixes the issue. Until upgraded, restrict outbound HTTP(S) access from the Allura server (e.g., allowlist webhook destinations and block internal/private IP ranges and cloud metadata endpoints such as 169.254.169.254), and review existing instances for configured webhooks.