How to Find SSRF Bugs That Pay: Hunting Server Side Request Forgery in URL Fetch and Image Import…
Medium2026-10-28
Web
Not rated
BUG BOUNTY WRITEUPS
SSRF writeups
Server-side request forgery: getting the server to fetch a URL for you. Read these for webhook and import-feature tricks, cloud metadata access and blind SSRF that still leaks data.
82 reports and writeups from 2024 to 2026. 46 carry a severity from the disclosing platform, 26 of them rated High or Critical. Last updated 2026-10-30.
Latest SSRF reports
Search and filter all writeupsCVE-2026-35273: SSRF to RCE in Oracle PeopleSoft
Researcher blog2026-10-27
Web
Not rated
SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards
HackerOneNextcloud2026-10-27$250 bounty
Web, Cloud
Medium
Blind SSRF Isn’t Blind If You Build the Channel Back
Researcher blog2026-10-24
Web, Cloud
Not rated
IDN decoding inserts authority delimiters and can redirect proxy CONNECT to a different host
HackerOnecurl2026-10-21
Web
High
SSRF via User-Controlled Push proxyServer in Notifications Push Registration
HackerOneNextcloud2026-09-30
Web, Cloud
Medium
Unauthenticated XXE leading to SSRF and internal resource access
Medium2026-09-30
Web
Not rated
How I Tricked OpenClaw Into Attacking Its Own Network: A NAT64 SSRF Bypass
InfoSec Write-ups2026-09-17
Web, AI
Not rated
SSRF with bypass leads to client side hosting / vulnerabilities ( XSS and others )
HackerOneDuckDuckGo2026-09-17$500 bounty
Web
Medium
Unauthenticated blind SSRF in Circles signature verification bypasses Nextcloud local-address protections
HackerOneNextcloud2026-09-17
Web, Cloud
Medium
SSRF via URL Parser Differential in `normalize_request_url` (wlc)
HackerOneWeblate2026-09-02
Web
High
50: CMake `HTTP_ONLY` does not disable SSH backends — SCP and SFTP remain usable
HackerOnecurl2026-08-29
Web
Not rated
Unauthenticated SSRF in Voxtelesys integration ('checkUrlForSsrf' Bypass via DNS rebinding)
HackerOneRocket.Chat2026-07-29
Web
High
AWS *.a2z.com | Unauthenticated Clickhouse UI : Database access + SSRF
HackerOneAWS VDP2026-07-22
Web, Cloud
High
SSRF via improper validation after DNS name resolution in the link-preview feature
HackerOneRocket.Chat2026-06-11
Web
High
SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function
HackerOneRocket.Chat2026-06-11
Web
Medium
curl-ipv4-percent-normalization-SSRF
HackerOnecurl2026-06-10
Web
Medium
Blind POST SSRF via Web Push Notification Endpoint
HackerOnephpBB2026-05-30
Web, API
Medium
SSRF Filter Bypass via Unblocked NAT64 Local-Use IPv6 Prefix (64:ff9b:1::/48)
HackerOnearkadiyt-projects2026-03-31
Web
High
Unauthenticated SSRF via Public Reference API -Sharing Token Bypass
HackerOneNextcloud2026-03-31
Web, API, Cloud
Not rated
Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)
HackerOneNode.js2026-02-12
Web
Medium
Gopher Protocol Command Injection (SSRF Smuggling)
HackerOnecurl2026-01-14
Web
High
CVE‑2025‑4123 — Grafana Open Redirect → Stored XSS → SSRF (Full Read) at ██████
HackerOneU.S. Dept Of Defense2026-01-12
Web
High
HTTP Request Smuggling and SSRF via CRLF Injection in Curl_add_custom_headers
HackerOnecurl2026-01-02
Web
High
[nextcloud/mail] Blind SSRF to Internal Network via "List-Unsubscribe" SMTP Header when allow_local_remote_servers is allowed
HackerOneNextcloud2025-12-23
Web, Cloud
Medium
Link unfurling calls out to arbitrary URLs and the private-network guard misses link-local addresses
HackerOneBasecamp2025-12-22
Web
Medium
File URL UNC Path Access (Windows SSRF)
HackerOnecurl2025-12-18
Windows
High
[my.stripo.email] Blind SSRF Vulnerability in Stripo App Export via Missing Endpoints Export Email Message to Zapier
HackerOneStripo Inc2025-12-01
Web, API
Critical
DNS Rebinding Attack
HackerOnearkadiyt-projects2025-10-19
Web
Critical
DNS Rebinding SSRF in Burp Suite MCP Server Enables Internal Network Access via send_http1_request Tool
HackerOnePortSwigger Web Security2025-10-08
Web, AI
Not rated
Unsanitized IPFS CID Allows SSRF Against Configured Gateway
HackerOnecurl2025-10-03
Web
Medium
Inconsistent URL Parsing in curl Leading to Potential SSRF and Access Control Bypass
HackerOnecurl2025-09-26
Web
Low
Server-Side Request Forgery (SSRF) via Game Export API
HackerOneLichess2025-06-03
Web, API
Critical
SSRF in Autodesk Rendering leading to account takeover
HackerOneAutodesk2025-03-18
Web
Critical
Blind SSRF Vulnerability in Appstore Release Upload Form
HackerOneNextcloud2025-01-14
Web, Cloud
Low
External service interaction (HTTP)
HackerOneAWS VDP2024-10-04
Web, Cloud
High
SSRF via host header let access localhost via https://go.dialexa.com
HackerOneIBM2024-10-03
Web
Medium
SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ci
HackerOneMTN Group2024-09-26
Web
Medium
SSRF and secret key disclosure found on Turbonomic endpoint
HackerOneIBM2024-09-19
Web, API
High
SSRF and secret key disclosure found on Turbonomic endpoint
HackerOneIBM2024-09-19
Web, API
High
Directory Traversal, SQL Injection and Server-Side Request Forgery
Researcher blogSage2024-09-10
Web
Not rated
IIS welcome page to source code review to LFI!
Medium2024-09-01
Web, Source Code
Not rated
important: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (CVE-2024-40898)
HackerOneInternet Bug Bounty2024-08-27$4,263 bounty
Windows
High
Blind SSRF vulnerability on cz.acronis.com
HackerOneAcronis2024-08-27
Web
Medium
NTLM Credential Theft in Python Windows Applications
Researcher blogPython, Hugging Face (Gradio), Werkzeug2024-08-23
Source Code, Windows
Not rated
Vulnerabilities in Homepage Dashboard
Researcher blogHomepage2024-08-22
Web
Not rated
SSRFing the Web with the help of Copilot Studio
Researcher blogGitHub (Copilot)2024-08-20
Web, AI
Not rated
CVE-2024-38428 Wget Vulnerability: All you need to know
Researcher blogGNU Wget2024-08-12
Web, Source Code
Not rated
Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!
Researcher blogApache HTTP Server, ModSecurity, Redmine2024-08-09
Web
Not rated
Listen to the whispers: web timing attacks that actually work
PortSwigger Research2024-08-07
Web
Not rated
Unauthenticated full-read SSRF via Twilio integration
HackerOneRocket.Chat2024-08-04
Web
High
/applications/dpc_(get|post) provide full access to api.steampowered.com with the Dota2 API key
HackerOneValve2024-07-30
Web, API
High
Canary Token OSS Security Audit Report (Q2 2024)
Researcher blogThinkst (OSS Canary Tokens)2024-07-23
Web
Not rated
important: Apache HTTP Server on WIndows UNC SSRF (CVE-2024-38472)
HackerOneInternet Bug Bounty2024-07-13$4,920 bounty
Windows
High
Unauthenticated SSRF on Havoc C2 teamserver via spoofed demon agent
Researcher blogHavoc C22024-07-13
Web, Source Code
Not rated
Shelltorch Explained: Multiple Vulnerabilities in Pytorch Model Server (Torchserve) (CVSS 9.9, CVSS 9.8) Walkthrough
Researcher blogPyTorch, AWS, Google2024-07-08
Web, Cloud, AI
Not rated
The PDF Trojan Horse: Leveraging HTML Injection for SSRF and Internal Resource Access
Medium2024-07-05
Web
Not rated
A story of a nice SSRF vulnerability.
Medium2024-07-03$500 bounty
Web
Not rated
Incorrect Encoding Conversion in hostname results in indeterminate SSRF vulnerabilities
HackerOnecurl2024-06-18
Web
Low
How I get an easy Blind SSRF by just reading writeups
Medium2024-06-12
Web
Not rated
These Services Shall Not Pass: Abusing Service Tags to Bypass Azure Firewall Rules (Customer Action Required)
Researcher blogMicrosoft (Azure)2024-06-03
Web, Cloud
Not rated
Digging for SSRF in NextJS apps
Researcher blogVercel (NextJS)2024-05-09
Web, Source Code
Not rated
Incorrect Type Conversion in interpreting IPv4-mapped IPv6 addresses and below `curl` results in indeterminate SSRF vulnerabilities.
HackerOnecurl2024-05-08
Web
Critical
Libuv: Improper Domain Lookup that potentially leads to SSRF attacks
HackerOneInternet Bug Bounty2024-03-29$4,860 bounty
Web
High
Micro Services, Major Headaches: Detecting Vulnerabilities in Erxes' Microservices
Researcher blogErxes2024-03-21
Web, API, Source Code
Not rated
The story of exposed service, SSRF, CSP bypass and credentials stealing via XSS
Researcher blog2024-03-20$200 bounty
Web
Not rated
Lack of sanitization of the billing address in pdf invoice
HackerOneSemrush2024-03-06
Web
High
Judge0 Sandbox Escape
Researcher blogJudge02024-02-29
Web, Source Code
Not rated
Tableau Server - There Ain't No Vulns
GitHubSalesforce (Tableau)2024-02-19
Web
Not rated
[SSRF] my.stripo.email via the setup-wizard parameter
HackerOneStripo Inc2024-02-15
Web
Critical
SSRF on a Headless Browser Becomes Critical!
Medium2024-02-03$2,000 bounty
Web
Not rated
Auth Bypass Round Two
Researcher blogIvanti2024-02-02
Web, Source Code
Not rated
Server Side Request Forgery (SSRF) in webhook functionality
HackerOneHackerOne2024-01-30$2,500 bounty
Web
Medium
Unleashing the power of CSS injection: The access key to an internal API
MediumPrince2024-01-24
Web, API
Not rated
SSRF in https://couriers.indrive.com/api/file-storage
HackerOneinDrive2024-01-16
Web, API
High
Internal Blind Server-Side Request Forgery (SSRF) allows scanning internal ports
HackerOneMozilla2024-01-12
Web
Not rated
Weird bug to steal users credentials
Medium2024-01-12
Web
Not rated
Hunting for SSRF Bugs in PDF Generators
Researcher blog2024-01-11
Web
Not rated
Blind SSRF in Mail App
HackerOneNextcloud2024-01-10
Web, Cloud
Low
A Glossary of Blind SSRF Chains
Researcher blog2024-01-03
Web
Not rated
Encrypting our way to SSRF in VMWare Workspace One UEM (CVE-2021-22054)
Researcher blog2024-01-02
Web
Not rated
DNS pin middleware can be tricked into DNS rebinding allowing SSRF
HackerOneNextcloud2024-01-01
Web, Cloud
Medium
Every entry links to the original report or article. Secure Hyperloop doesn't copy the content. Severity comes from the disclosing platform (HackerOne). Writeups without a platform rating show "Not rated". The index has 2,810 items in total.