← All advisories

Critical severity9.1NVD Advisory· Published Aug 11, 2026· Updated Aug 17, 2026

CVE-2026-69223

CVE-2026-69223

Description

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2

Apache/Allura2 versions
cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:allura:*:*:*:*:*:*:*:*range: <1.19.1
- (no CPE)range: <1.19.1

Patches

Vulnerability mechanics

References

3

www.openwall.com/lists/oss-security/2026/08/11/4nvdMailing ListThird Party Advisory
lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pbnvdMailing ListVendor Advisory
allura.apache.org/posts/2026-allura-1.19.1.htmlnvdRelease Notes

News mentions

1

Apache Projects Hit by 25 Vulnerabilities in Coordinated August 2026 Disclosure
Vypr Intelligence · Aug 15, 2026