CVE-2026-127093

Description

Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response.

References

• https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/routes/alerts.rs#L422-L479
• https://github.com/rustrak/rustrak/blob/v0.25.0/apps/server/src/services/notification/webhook.rs#L161-L250
• https://github.com/rustrak/rustrak/commit/f41c464ec56954b1876062d70aef920e786ca40b
• https://github.com/rustrak/rustrak/issues/504
• https://github.com/rustrak/rustrak/pull/525