The CVSS 5.5 score for this SSRF in Unleash's addon subsystem understates the actual risk. The vulnerability sits at the intersection of three dangerous patterns: credential forwarding, structured oracle probing, and a hub-and-spoke integration architecture that turns a single primitive into a multi-target platform.
The credential forwarding vector is the most immediate concern. An attacker with CREATE_ADDON or UPDATE_ADDON permission can configure integrations to forward Authorization headers, customHeaders, and API keys—including Datadog keys—to attacker-controlled URLs. The non-obvious escalation path: a user with these permissions can harvest their own elevated credentials by observing where those values land. This isn't theoretical credential leakage; it's a privilege escalation mechanism disguised as configuration. If your permission model treats CREATE_ADDON as a routine admin task rather than a security-sensitive operation, the attack surface expands accordingly.
The integration-status oracle transforms this from a limited SSRF into a network reconnaissance tool. You cannot see response bodies, but you can infer internal state through status codes, retry behavior, and timing. Error codes from Unleash's own retry logic differ from raw connection failures—a timeout may indicate a firewall, a specific status code may indicate the service exists but rejected your payload. This structured feedback loop makes programmatic fingerprinting possible and bypasses most anomaly detection because the requests originate from legitimate internal infrastructure.
The architectural concentration matters. The vulnerability lives in the shared fetch-retry path in addon.ts, which every integration inherits. This means the fix required changes to shared infrastructure, not per-integration hardening. Before declaring this patched, audit your deployment for any custom, community, or deprecated integrations that may still inherit from the vulnerable pattern. The CVE enumerates five integrations; the actual attack surface may be larger.
Prioritize this above typical CVSS 5.5 findings. The multi-branch fix timeline (7.5.2, 7.6.5, 8.0.2) means older release trains remained exposed longer—not through risk decisions, but upgrade cadence. The credential harvesting axis may have a silent exploitation window predating the CVE disclosure, since attackers harvesting their own keys have no reason to report it.