Critical · 9.1 CVE-2026-80181 EUVD-2026-70922GHSA-56gv-mfrw-xf8j

Apache Allura: Server-side request forgery

Published Sep 4, 2026 · Updated Sep 8, 2026 · Assigned by apache

Description

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).

This issue affects Apache Allura: through 1.20.0.

Users are recommended to upgrade to version 1.21.0, which fixes the issue.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Allura	≤ 1.20.0	—