Ech0 versions through 4.2.1 enable an attacker with administrative privileges to create a webhook that contains a hostname resolving to an internal or private IP address. The validateWebhookURL function only accepts literal IP addresses via net.ParseIP and does not reject hostnames that resolve to private ranges; as a result the Ech0 server performs HTTP requests to those endpoints. This allows the attacker to reach internal services, cloud metadata endpoints, and other private resources, potentially exposing sensitive data and facilitating further pivoting within the network.

The vulnerability applies to Ech0 deployments provided by lin‑snow. All releases up to and including version 4.2.1 are affected, and the issue is resolved in version 4.4.3.

The CVSS score for this issue is 5.1, indicating moderate impact. The EPSS score is not reported, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires administrative access to the Ech0 instance in order to configure a malicious webhook. Once set up, the server will issue outbound requests that can reach internal resources, so the risk is contingent upon the attacker's privilege level and the untightened network environment.