Description

Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services including RFC 1918 addresses and cloud metadata endpoints. Attackers can create webhooks targeting private networks and exfiltrate annotation data by enabling payload transmission in outbound requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-03T15:17:39.097Z",
  "pubdate": "2026-09-03T15:17:39.097Z",
  "executiveSummary": "Label Studio versions up to 1.23.0 are susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to improper input validation of webhook URL configurations. This flaw allows an authenticated attacker to force the application server to perform outbound HTTP requests directed at arbitrary network locations.\nThe vulnerability poses significant risk to internal infrastructure by enabling attackers to bypass network perimeters, interact with internal services residing on RFC 1918 private address spaces, and access cloud metadata services (e.g., AWS/GCP instance metadata APIs). Successful exploitation requires an authenticated session with sufficient privileges to manage webhooks.\nThe impact includes unauthorized reconnaissance of internal networks, potential credential exfiltration via interaction with metadata endpoints, and the unauthorized transmission of sensitive annotation data to attacker-controlled external listeners. Organizations should prioritize access control restrictions and implement strict network egress filtering to mitigate this exposure.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of the target URL parameter when configuring webhook notifications in Label Studio. The application fails to implement a blocklist or allowlist mechanism to sanitize the destination URI, allowing requests to be routed toward restricted IP ranges and hostnames.\nThe attack vector necessitates an authenticated user context. Once authenticated, an attacker can navigate to the webhook configuration interface and supply a malicious URL. When the configured event is triggered, the application server initiates an asynchronous HTTP request to the specified destination. Because the server does not enforce network segmentation or hostname resolution restrictions, the request is dispatched from the context of the Label Studio server.\nThe exploitation flow proceeds as follows: First, the attacker provides an arbitrary URI in the webhook target field, such as http://169.254.169.254/latest/meta-data/ for cloud instances or internal IP addresses (e.g., http://10.0.0.1:8080). Second, the attacker triggers a condition that causes a webhook event to fire, forcing the application to process the request. Third, the backend server executes an HTTP request to the target. Fourth, by enabling payload transmission within the webhook settings, the attacker can cause the server to forward sensitive annotation data or configuration details contained in the request body to an external listener controlled by the attacker if the target allows, or alternatively, the attacker may attempt to perform blind SSRF for service discovery.\nThis vulnerability is particularly dangerous in cloud-native environments where the Label Studio instance is assigned an IAM role. By targeting the Instance Metadata Service (IMDS), an attacker may successfully exfiltrate temporary security credentials associated with the instance. Furthermore, the ability to scan internal services allows for the mapping of the internal network topology and potential interaction with internal APIs that lack secondary authentication, as they might trust requests originating from the internal network. The lack of validation on the scheme and port parameters further expands the attack surface, potentially allowing the use of various URI protocols supported by the underlying HTTP library.\nAffected versions include all iterations of Label Studio up to and including 1.23.0. The vulnerability exists within the application's webhook dispatching component, which executes these requests with the full authority of the service's process account."
}