AIKIDO-2026-26845

TL;DR

Canvas validates a webhook URL's hostname by resolving it once and checking that every A and AAAA address is public, then delivers the webhook through a separate HTTP client call that resolves the same hostname again independently. A hostname under externally controlled DNS can resolve to a public address during validation and to a private or internal address during delivery, letting the outbound webhook request reach internal network targets. The fix resolves both A and AAAA records up front, rejects any private or mixed resolution, and pins the delivery connection to the validated address with CURLOPT_RESOLVE while enforcing HTTPS and failing closed when curl pinning is unavailable.