diff --git a/apps/api/plane/bgtasks/webhook_task.py b/apps/api/plane/bgtasks/webhook_task.py
index dd41575056..ddb5299fb5 100644
--- a/apps/api/plane/bgtasks/webhook_task.py
+++ b/apps/api/plane/bgtasks/webhook_task.py
@@ -334,7 +334,15 @@ def webhook_send_task(
         )
 
         # Send the webhook event
-        response = requests.post(webhook.url, headers=headers, json=payload, timeout=30)
+        # allow_redirects=False prevents SSRF via 3xx hops to internal addresses
+        # bypassing the validate_url() check above (GHSA-mq87-52pf-hm3h).
+        response = requests.post(
+            webhook.url,
+            headers=headers,
+            json=payload,
+            timeout=30,
+            allow_redirects=False,
+        )
 
         # Log the webhook request
         save_webhook_log(