The Strapi Core Admin and Webhook Runner components include a webhook dispatcher that automatically follows HTTP redirects. The dispatcher does not re‑resolve the target IP address, nor does it perform RFC1918 or link‑local boundary checks. Non‑2xx responses from the redirected endpoint are captured and returned directly to the caller that initiated the webhook. This permits an attacker to make Strapi fetch arbitrary URLs—including internal network services—and obtain the response payload, potentially exposing internal network details, sensitive data, or enabling further attacks.

Strapi Open Source and Enterprise Headless CMS. The fix is introduced in release v5.51.0, so earlier versions may be susceptible.

No CVSS or EPSS score is disclosed and the issue is not listed in the CISA KEV catalog. The absence of redirect validation means exploitation can be achieved by triggering a webhook that redirects to a target of the attacker’s choice. The semi‑blind nature allows the attacker to receive any non‑2xx response body, which can leak information about internal infrastructure.