Webhook delivery looks like a narrow feature: an administrator supplies a URL, Strapi sends an event, and the receiving service does the work. CVE-2026-118172 shows how redirect handling can turn that feature into a semi-blind SSRF. The public record attributes the flaw to the Core Admin Webhook Runner in strapi/strapi.
The exact trigger is a webhook that follows a redirect to a destination the original validation did not intend to allow. The response may not be returned to the attacker in full, which is why the flaw is described as semi-blind. Status codes, timing and errors can still disclose whether a destination exists or which service answered.
The web tier is the wrong place to enforce destination trust
A redirect can change the destination after the first URL check. That makes allowlist logic fragile when it runs only once at webhook creation or only on the initial string. The runner should evaluate every redirect hop and resolve the final destination against a network policy that blocks loopback, private, link-local and metadata ranges.
Network filtering still matters because application validation may have edge cases. Put webhook egress behind a proxy that can reject disallowed destinations and record the final resolved address. If webhook delivery needs to reach a private receiver, create a named destination with an explicit owner rather than letting a user enter an arbitrary URL.
Inventory the hidden endpoints
The webhook configuration may live in the database and never appear in a page scan. Export the list of configured webhook URLs, owners, event types and last-delivery times. Look for URLs that point to internal hostnames, alternate ports, URL shorteners, redirectors or addresses that changed after approval.
Upgrade the affected Strapi package to a fixed release. The CVE summary reviewed for this article states that the issue is fixed in 2.8.2. Administrators should confirm the exact package coordinate and release line in the Strapi advisory before applying the change, because the Core Admin and review-workflow packages can be versioned independently.
After the update, resend a non-destructive test event to an approved receiver. Then test a controlled redirect to a disallowed destination. A patched runner should fail closed and log the rejection without exposing the internal response body.
Investigate delivery history
Review web server, proxy, DNS and application logs for webhook requests that ended at internal addresses. The stub request may be visible in the proxy, while the target service sees a request from the Strapi host. Correlate timestamps and source ports where available.
Look for repeated requests to neighbouring ports, short connect failures and successful requests to administrative paths. The runner may retry failed deliveries, so a single configuration can generate many probes. Do not treat a timeout as harmless until the destination policy and DNS resolution have been checked.
If an internal service accepted a webhook request, inspect its logs for the headers and body sent by Strapi. The event payload may contain content titles, author identities or other metadata that was not intended for an internal endpoint.
Make redirect behavior a review item
Every outbound fetcher in the application should have an explicit redirect policy. Prefer no redirects for administrative webhooks, or a small allowlist of destinations that remains valid across the chain. Resolve the host, check the address and connect to the validated address. Repeat the checks when a redirect occurs or DNS answers change.
This is also an authorization issue. Only administrators who understand the network consequence should create or edit webhooks. Log who changed the URL, why it changed and when it was last tested. The webhook runner should not inherit unrestricted network reach from the Strapi process just because the feature is convenient.