CVE-2026-57947: Microsoft APM SSRF — HIGH

CISO Take

Pinpoint APM through 3.1.0 lets any authenticated user register a webhook URL for alarm notifications without server-side request forgery protection, and then force the server to POST to that URL by triggering an alarm threshold breach — including internal hosts and cloud metadata endpoints. A CISO should care because this is a scope-changing SSRF (CVSS 8.5, S:C) that turns a monitoring tool into a pivot point for reaching internal network resources and metadata services, even though it only requires low privileges and no user interaction. The mitigating factors are real: EPSS sits at 0.24% (top 85th percentile, not top-tier), there's no CISA KEV listing, no public exploit or Nuclei template, and zero tracked downstream dependents limit blast radius today. Because Pinpoint is commonly deployed to monitor application and inference stacks, treat this as high priority if Pinpoint sits anywhere near AI/ML infrastructure: patch to the fixed release once published, and in the meantime block outbound requests from the Pinpoint host to RFC1918 ranges and the 169.254.169.254 metadata IP via egress controls.

Sources: NVD EPSS ATLAS vulncheck.com GitHub

What is the risk?

CVSS 3.1 base score 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) reflects a network-exploitable, low-complexity SSRF with scope change — meaning the compromised component (the webhook subsystem) can be used to affect resources beyond its own security boundary, i.e., internal hosts and cloud metadata services. Exploitability is tempered by the requirement for a low-privileged authenticated account, and real-world exploitation signals are currently low: EPSS 0.239% (85th percentile), no CISA KEV entry, no SSVC decision, no public exploit code, and no Nuclei template. Package risk score is 0/100 with zero tracked downstream dependents, indicating limited current adoption within tracked AI/ML supply chains, though the package has 6 other historical CVEs, suggesting a pattern of recurring input-validation gaps.

How does the attack unfold?

Initial Access

An authenticated low-privilege user registers a webhook URL pointing to an internal host or cloud metadata endpoint via Pinpoint's alarm registration endpoint, which lacks SSRF validation.

AML.T0049

Trigger Condition

The attacker waits for or manipulates monitored metrics to force an alarm threshold breach, activating the webhook notification.

SSRF Exploitation

The Pinpoint server issues an outbound POST request on the attacker's behalf to the registered internal URL or cloud metadata service.

AML.T0075

Impact

The attacker captures internal service responses or cloud credentials, enabling unauthorized access to internal network resources hosting AI/ML infrastructure.

Initial Access

An authenticated low-privilege user registers a webhook URL pointing to an internal host or cloud metadata endpoint via Pinpoint's alarm registration endpoint, which lacks SSRF validation.

AML.T0049

Trigger Condition

The attacker waits for or manipulates monitored metrics to force an alarm threshold breach, activating the webhook notification.

SSRF Exploitation

The Pinpoint server issues an outbound POST request on the attacker's behalf to the registered internal URL or cloud metadata service.

AML.T0075

Impact

The attacker captures internal service responses or cloud credentials, enabling unauthorized access to internal network resources hosting AI/ML infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Microsoft APM	pip	—	No patch
3.5K Pushed 5d ago 67% patched ~7d to patch Full package profile →

Do you use Microsoft APM? You're affected.

How severe is it?

CVSS 3.1

8.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I Low

A None

What should I do?

1 step

Upgrade Pinpoint beyond version 3.1.0 once an official patched release is available (patched version not yet specified in the advisory — track https://github.com/pinpoint-apm/pinpoint/issues/13857 for the fix). Until patched, apply compensating controls: enforce an egress allowlist so the Pinpoint server cannot reach RFC1918 private ranges or the 169.254.169.254 metadata IP; require IMDSv2 on AWS-hosted instances to blunt metadata-endpoint SSRF; restrict webhook-registration privileges to trusted admin roles rather than all authenticated users; and add detection for alarm-webhook registrations pointing to internal/loopback/link-local addresses. Review Pinpoint's audit logs for recent webhook registrations and alarm trigger events as a compromise-assessment step.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Inference Plugin AML.T0049 - Exploit Public-Facing Application AML.T0075 - Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

Clause 8.1 - Operational Planning and Control

NIST AI RMF

GOVERN 6.1 - Third-Party Risk Policies

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-57947?

Pinpoint APM through 3.1.0 lets any authenticated user register a webhook URL for alarm notifications without server-side request forgery protection, and then force the server to POST to that URL by triggering an alarm threshold breach — including internal hosts and cloud metadata endpoints. A CISO should care because this is a scope-changing SSRF (CVSS 8.5, S:C) that turns a monitoring tool into a pivot point for reaching internal network resources and metadata services, even though it only requires low privileges and no user interaction. The mitigating factors are real: EPSS sits at 0.24% (top 85th percentile, not top-tier), there's no CISA KEV listing, no public exploit or Nuclei template, and zero tracked downstream dependents limit blast radius today. Because Pinpoint is commonly deployed to monitor application and inference stacks, treat this as high priority if Pinpoint sits anywhere near AI/ML infrastructure: patch to the fixed release once published, and in the meantime block outbound requests from the Pinpoint host to RFC1918 ranges and the 169.254.169.254 metadata IP via egress controls.

Is CVE-2026-57947 actively exploited?

No confirmed active exploitation of CVE-2026-57947 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-57947?

Upgrade Pinpoint beyond version 3.1.0 once an official patched release is available (patched version not yet specified in the advisory — track https://github.com/pinpoint-apm/pinpoint/issues/13857 for the fix). Until patched, apply compensating controls: enforce an egress allowlist so the Pinpoint server cannot reach RFC1918 private ranges or the 169.254.169.254 metadata IP; require IMDSv2 on AWS-hosted instances to blunt metadata-endpoint SSRF; restrict webhook-registration privileges to trusted admin roles rather than all authenticated users; and add detection for alarm-webhook registrations pointing to internal/loopback/link-local addresses. Review Pinpoint's audit logs for recent webhook registrations and alarm trigger events as a compromise-assessment step.

What systems are affected by CVE-2026-57947?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference pipelines, MLOps/observability tooling.

What is the CVSS score for CVE-2026-57947?

CVE-2026-57947 has a CVSS v3.1 base score of 8.5 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

model servinginference pipelinesMLOps/observability tooling

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0075 Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Pinpoint through 3.1.0 contains a server-side request forgery vulnerability in the webhook registration endpoint that allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Exploitation Scenario

An attacker with a low-privileged, authenticated account on a Pinpoint APM instance monitoring an organization's AI inference or agent-serving stack registers a webhook URL pointing to the cloud provider's instance metadata service (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) as part of an alarm notification rule. The attacker then either waits for a genuine alarm threshold breach (e.g., high latency on a model-serving endpoint) or manipulates monitored metrics to force one. When the alarm fires, the Pinpoint server itself issues the outbound POST request to the attacker-specified internal URL, returning the metadata response (potentially including temporary IAM credentials) to the attacker via the webhook payload or logs, enabling lateral movement into the internal network hosting model-serving, vector database, or MLOps infrastructure.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.