Ech0 before 4.4.3 contains a server‑side request forgery vulnerability in the validateWebhookURL function, which only validates literal IP addresses via net.ParseIP() and fails to reject hostnames that DNS‑resolve to private or internal IPs (e.g., 169.254.169.254.nip.io). An attacker with administrative privileges can create a webhook with such a hostname to bypass validation, resulting in the Ech0 server making outbound requests to internal services, cloud metadata endpoints, and other private network resources. This can expose sensitive data and enable lateral movement within the network.

The vulnerability applies to Ech0 deployments from lin‑snow. All releases prior to version 4.4.3 are affected, and the issue is resolved in version 4.4.3.

The CVSS score for this issue is 5.1, indicating moderate impact. The EPSS score is <1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires administrative access to the Ech0 instance in order to configure a malicious webhook. Once set up, the server will issue outbound requests that can reach internal resources, so the risk is contingent upon the attacker's privilege level and the untightened network environment.