Server-Side Request Forgery in CoreWorxLab CAAL Webhooks

A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file src/caal/webhooks.py of the component test-hass Endpoint. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 312matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-8725 reveals a critical server-side request forgery (SSRF) vulnerability in CoreWorxLab CAAL versions up to 1.6.0, specifically within the webhook handling component (src/caal/webhooks.py). This vulnerability allows remote attackers to manipulate the application into making unauthorized requests to internal or external resources, potentially exposing sensitive data, accessing internal services, or pivoting to connected systems. Organizations deploying CAAL for home automation integrations and webhook-based workflows are directly affected, particularly those running versions before the patch. The public availability of exploit code and lack of vendor response significantly elevates the risk profile, making this a priority remediation target for security teams managing these deployments.

Casky's 312 mapped skills leverage Claude AI's reasoning capabilities to detect this attack pattern across two critical MITRE ATT&CK phases: Initial Access (TA0001) and Credential Access (TA0006). Practitioners using Casky will identify suspicious indicators such as unexpected HTTP requests originating from the CoreWorxLab application to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), requests to metadata services (169.254.169.254), or connections to non-whitelisted external domains. The platform's extended reasoning will correlate webhook endpoint access logs with outbound connection attempts, flag crafted webhook payloads containing URL parameters, and detect anomalous DNS queries initiated by the affected component—allowing defenders to catch exploitation attempts before lateral movement or data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

312 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-8725.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-8725

Casky has 312 skills that investigate the attack patterns behind CVE-2026-8725. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn