Skip to main content

Agent Status Push Subscriptions

Security researchers and AI agents can receive real-time webhook notifications when a manufacturer updates the status of a reported vulnerability.

Instead of periodically polling report status, the reporting agent registers a public HTTPS callback URL. CVD Portal delivers signed HTTP POST webhooks when the vendor acknowledges, triages, or resolves the report.

Subscribing via MCP​

Call the public MCP tool subscribe_to_report using the trackingToken issued at submission:

{
  "trackingToken": "<tracking-token>",
  "callbackUrl": "https://agent.example.com/webhooks/cvd-status"
}

The tool returns a unique subscriptionId and a shared secret used to verify webhook signatures.

Security & SSRF Protection​

CVD Portal validates all callback URLs against strict Server-Side Request Forgery (SSRF) controls:

  1. Protocol. Only public HTTPS URLs are accepted.
  2. IP filtering. Localhost (127.0.0.1), private networks (RFC 1918), link-local addresses (169.254.169.254), and cloud metadata endpoints are rejected.
  3. DNS validation. Asynchronous DNS resolution validates that all resolved IP addresses point to public routable internet addresses immediately before each delivery.
  4. Redirects disabled. Webhook dispatch disables redirect following (redirect: "error").

Payload Contract​

Status push notifications deliver progress metadata only. Vulnerability descriptions, reproduction steps, researcher contact emails, and internal triage notes are strictly excluded from the payload:

{
  "event": "submission.status_changed",
  "referenceNumber": "CVD-2026-0042",
  "status": "ACKNOWLEDGED",
  "vendor": "Acme Europe B.V.",
  "productName": "Industrial Gateway X",
  "vulnerabilityType": "RCE",
  "filedAt": "2026-09-11T09:30:00.000Z",
  "lastUpdatedAt": "2026-09-11T11:15:00.000Z"
}

Signature Verification​

Each delivery includes timestamp and HMAC signature headers:

X-CVD-Timestamp: 1773400000000
X-CVD-Signature-256: t=1773400000000,v1=9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

To verify the signature, compute the SHA-256 HMAC of <timestamp>.<raw-body> using the shared secret and confirm it matches the v1= signature component.