CVE-2026-41688: Wallos SSRF Bypass via DNS Rebinding

The National Vulnerability Database has disclosed CVE-2026-41688, a high-severity Server-Side Request Forgery (SSRF) vulnerability affecting Wallos, an open-source personal subscription tracker. Versions 4.8.4 and prior are vulnerable. This flaw stems from an incomplete fix where Wallos validates webhook URLs using gethostbyname() but then passes the original hostname to cURL without CURLOPT_RESOLVE pinning for 10 out of 11 outbound HTTP endpoints.

This creates a classic Time-of-Check to Time-of-Use (TOCTOU) window, enabling DNS rebinding attacks. An attacker can manipulate DNS responses to bypass initial validation and direct Wallos to internal network resources, potentially leading to information disclosure or further internal network compromise. The National Vulnerability Database indicates a CVSSv3.1 score of 7.7 (High), with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, highlighting the network accessibility and high confidentiality impact.

For defenders, this means Wallos instances, particularly those exposed to untrusted users or configured with webhook functionality, are at risk. The attacker’s calculus here is clear: leverage the TOCTOU race condition to pivot from an apparently safe external URL to an internal IP address after the initial DNS lookup. At the time of this publication, no public patches are available, leaving affected instances exposed.