GCVE-110-VULN-PYPI-2026-000634

If you run aimarket-atlas 0.1.2 through 0.3.1 and let subscribers set watchbox webhooks, a subscriber can make your server send signed watchbox POSTs to addresses inside your network, at a path it chooses, and read from the watchbox log (GET /api/v1/watchboxes/{id}/log) the status code or exception of each attempt. watchboxes._validate_webhook refuses only IP literals and a few local names. In 0.1.2 delivery (delivery.DeliveryLoop._deliver) resolves nothing, so a name that points at a private address is contacted. In 0.3.0 and 0.3.1 delivery._non_public_resolution checks the name once and each of up to five attempts then posts by name, so a name that rebinds to a private address after the check is contacted. The delivery client honours HTTPS_PROXY, ALL_PROXY and SSL_CERT_FILE, so behind a TLS-inspecting egress proxy, which resolves the name itself and re-signs with a CA the server trusts, the POST reaches the internal service; without such a proxy it stops at the certificate check, and the logged error still maps which internal addresses and ports accept connections. Fixed in 0.3.2: every attempt resolves and checks the name and posts to the address that passed, with the name in Host and TLS SNI, so a proxy is asked to connect to that address only. Affects 0.1.2 through 0.3.1.