CVE-2026-92602

Executive Summary

CVE-2026-92602 is a server-side request forgery (SSRF) and broken access control vulnerability in TDuck, an open-source survey/form platform, affecting versions through 5.3. The WebhookConfigController fails to validate webhook destination URLs and does not verify that the authenticated user owns the target form, allowing any authenticated attacker to attach a webhook to another user's form and exfiltrate submission data to arbitrary external or internal endpoints. With a CVSS base score of 7.1, the flaw enables high-confidentiality impact including internal network reconnaissance and data theft, and no patch is currently available.

Technical Analysis

The vulnerability resides in TDuck's webhook configuration subsystem — specifically the documented WebhookConfigController. Per the NVD description, two distinct validation failures combine into a single exploitable condition:

1. Missing webhook URL validation (SSRF primitive). The controller accepts attacker-supplied webhook destination URLs without validating them. There is no allow-list, no scheme restriction enforcement, and no filtering of private/internal address ranges (loopback, RFC 1918, link-local, or cloud metadata endpoints). Because the server itself later issues the outbound HTTP request to deliver form submissions, the attacker controls where the server sends data. This is a classic SSRF condition mapped to CWE-918.

2. Missing form ownership verification (broken access control / IDOR-adjacent). The controller does not verify that the authenticated caller owns, or has permission over, the form to which the webhook is being attached. As a result, an attacker can bind a webhook to another user's form. The webhook then fires silently on that victim form's subsequent submissions.

The combination is more severe than either flaw alone. The ownership failure supplies the data source (victim form submissions), and the URL-validation failure supplies the exfiltration channel (arbitrary external/internal destination). Practically, this is an authenticated data exfiltration and internal-network access primitive rather than a simple SSRF.

Attack surface: The webhook configuration functionality of TDuck's HTTP API, reachable over the network (AV:N). No user interaction is required from the victim (UI:N) — the victim only needs to submit a form after the malicious webhook is attached. Attack complexity is low (AC:L) because no special conditions, race windows, or privileged prerequisites are required; the attacker simply needs any valid authenticated account (PR:L).

Subscores in context:

• Confidentiality: High (C:H) — submission data exfiltration plus potential internal service response data via SSRF.
• Integrity: Low (I:L) — the attack primarily reads/redirects data; it does not grant arbitrary write to the application's core data model.
• Availability: None (A:N) — no denial-of-service component is described.

Important accuracy note: The NVD description does not disclose the specific parameter names, request paths, or JSON fields used when configuring a webhook. Those implementation details are unknown and are deliberately not fabricated here; only the component name (WebhookConfigController), the product (TDuck survey form), and the affected version range (through 5.3) are verbatim from the source data.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (SSRF + broken access control) and the NVD description; no function names or parameters beyond those supplied are asserted.

1) Reconnaissance / target identification. The attacker identifies an internet-reachable TDuck instance running version 5.3 or earlier (e.g., via Shodan using the dorks above). The attacker registers or obtains any low-privilege account and enumerates form identifiers belonging to other users. Because the controller lacks ownership checks, no special access is needed — only a valid session.

2) Triggering the flaw class. Using the TDUCK webhook configuration functionality, the attacker submits a webhook definition that (a) is bound to a form they do not own (ownership check bypass) and (b) contains an attacker-controlled destination URL (URL validation bypass). This is the two-part authorization-and-validation failure described in the NVD entry.

3) Payload / execution method (vulnerability-class level). The attacker chooses a destination URL. For external exfiltration, the URL points to an attacker-controlled listener. For internal SSRF, the URL points to an internal address (e.g., http://127.0.0.1/..., an RFC 1918 host, or a cloud metadata endpoint) to probe services not reachable from the internet. Execution occurs when TDuck later processes a submission on the poisoned form and issues the outbound HTTP request to the attacker-specified URL. No further interaction by the attacker is required after configuration.

4) Post-exploitation impact. All subsequent submissions to the victim form — including any fields captured by that form — are delivered to the attacker's endpoint. Where the destination is an internal address, the server's response may leak internal service data or confirm reachability of backend systems (SSRF reconnaissance). The attacker can repeat this across multiple victim forms for broad, persistent collection.

Impact Assessment

• Confidentiality (High): Submission data from victim forms is exfiltrated to arbitrary endpoints; internal services may be probed via SSRF. Survey/submission data frequently includes PII, credentials, or business-sensitive content.
• Integrity (Low): The attacker alters webhook configuration state on forms they do not own; core business records are not directly modified per the description.
• Availability (None): No DoS impact is described.
• Blast radius: Any multi-tenant or multi-user TDuck 5.3 (or earlier) deployment where authenticated users can configure webhooks. The victim's data flows to attacker infrastructure natively (the feature is "working as designed" for the attacker), meaning exfiltration may be silent and blend with legitimate webhook egress.
• Secondary exposure: In cloud deployments, an unvalidated destination URL raises the risk of reaching instance metadata services, potentially enabling credential theft chains beyond the survey platform itself.

No EPSS score is available (not yet scored by FIRST.org), and CVE-2026-92602 is not listed in CISA KEV. No exploit-in-the-wild or threat-actor campaign is documented in the provided data.

Detection Guidance

Sigma Rule

title: TDuck Webhook Configuration Abuse (CVE-2026-92602)
id: 7c9f1b2a-4d3e-4a5b-9c0d-2f6e8a1b3c4d
status: experimental
description: Detects creation or modification of survey form webhook configuration, indicating potential SSRF / cross-tenant webhook abuse in TDuck <= 5.3
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92602
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.92602
logsource:
  category: application
  product: tduck
detection:
  selection_endpoint:
    http.url|contains:
      - 'WebhookConfigController'
      - 'webhook'
  selection_action:
    http.method:
      - 'POST'
      - 'PUT'
  selection_suspicious_target:
    http.request.body|contains:
      - '127.0.0.1'
      - 'localhost'
      - '169.254.169.254'
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_endpoint and selection_action and selection_suspicious_target
falsepositives:
  - Legitimate webhooks configured to internal corporate endpoints by administrators
level: medium

YARA Rule

rule CVE_2026_92602_TDuck_Webhook_SSRF
{
    meta:
        description = "Detects references to TDuck WebhookConfigController and internal-target webhook abuse patterns (CVE-2026-92602)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92602"
        date = "2026-01-01"
        severity = "high"

    strings:
        $c1 = "WebhookConfigController" ascii wide nocase
        $c2 = "webhookUrl" ascii wide nocase
        $c3 = "webhook_url" ascii wide nocase
        $c4 = "formKey" ascii wide nocase
        $s1 = "169.254.169.254" ascii wide
        $s2 = "localhost" ascii wide nocase
        $s3 = "127.0.0.1" ascii wide

    condition:
        $c1 or ($c2 or $c3) and 1 of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92602 TDuck WebhookConfigController SSRF Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"webhook"; nocase; http.request_body; content:"169.254.169.254"; nocase; sid:9260201; rev:1; metadata:cve CVE-2026-92602, author valtersit.com;)
alert http any any -> any any (msg:"CVE-2026-92602 TDuck Webhook Internal Target"; flow:established,to_server; http.request_body; content:"WebhookConfigController"; nocase; http.request_body; pcre:"/(127\.0\.0\.1|localhost|10\.|192\.168\.|172\.16\.)/i"; sid:9260202; rev:1; metadata:cve CVE-2026-92602, author valtersit.com;)

Elastic Detection

sequence by user.id with maxspan=5m
  [ network where process.name : ("java" or "java*") and
      url.path : "*webhook*" and http.request.method : ("POST" or "PUT") ]
  [ network where destination.ip : ("127.0.0.1","169.254.169.254") or
      cidr_match(destination.ip,"10.0.0.0/8","192.168.0.0/16","172.16.0.0/12") ]

Splunk SPL Query

index=web OR index=proxy OR index=app
(uri_path="*webhook*" OR uri_path="*WebhookConfigController*")
(method="POST" OR method="PUT")
| eval suspicious=if(
    match(request_body,"(?i)(127\.0\.0\.1|localhost|169\.254\.169\.254|169\.254\.|10\.|192\.168\.|172\.16\.)"),
    "INTERNAL_TARGET",
    if(match(request_body,"https?://"),"EXTERNAL_TARGET","UNKNOWN"))
| stats count values(uri_path) as paths values(suspicious) as target_type by src_ip user
| where target_type!="UNKNOWN"
| sort - count

Wazuh OSSEC Rule

<group name="tduck,webattack,">
  <rule id="926020" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">webhook</field>
    <description>CVE-2026-92602: TDuck webhook configuration activity detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="926021" level="12">
    <if_sid>926020</if_sid>
    <regex>(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.16\.)</regex>
    <description>CVE-2026-92602: TDuck webhook to internal/high-risk target (possible SSRF)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, workaround, or version correction has been published per tracked sources.

1. Immediate mitigations (no vendor patch available):
   • Restrict network egress from the TDuck server to only explicitly required destinations (deny RFC 1918, loopback, link-local, and cloud metadata ranges at the firewall/proxy layer). This directly neutralizes the SSRF channel.
   • Place TDuck behind an authenticated reverse proxy and limit webhook configuration to trusted, verified administrators only where the platform allows.
   • Enforce per-form ownership at an enforcing layer if feasible: require that only the form owner or a designated tenant admin can configure webhooks.
   • Monitor and alert on all outbound HTTP from the TDuck host to new/rare destinations.
   • If webhooks are not needed, disable the webhook feature entirely.
2. Patch/upgrade steps: No patched version exists. Monitor the TDuck project repository and vendor channels for a fixed release beyond 5.3. Until then, do not rely on a version upgrade as a control; apply the mitigations above and treat the deployment as vulnerable.
3. Long-term hardening: Implement server-side allow-listing of webhook destination schemes and hosts; block private/link-local/metadata addresses; add strict object-level authorization checks on all form-scoped configuration endpoints; adopt centralized outbound egress filtering; and add regression tests asserting that cross-user webhook attachment is rejected.

References

• NVD — CVE-2026-92602: https://nvd.nist.gov/vuln/detail/CVE-2026-92602
• MITRE CWE-918 (Server-Side Request Forgery): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (score pending for this CVE): https://www.first.org/epss/
• CISA KEV catalog (CVE-2026-92602 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / in-the-wild note: No exploit code, PoC, Nuclei template, EPSS score, CISA KEV listing, or documented threat-actor campaign exists for CVE-2026-92602 in the supplied data. All exploitation content above is inferred from the vulnerability class.