CVE-2026-72761
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-918
Falsificación de solicitud en servidor (SSRF)
Fecha de publicación:
10/08/2026
Última modificación:
10/08/2026
Descripción
*** Pendiente de traducción *** The webhook URL validator in `website/notifications/webhooks.py` uses<br />
`ip.is_global` to reject non-public addresses after DNS resolution. IPv6<br />
transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo<br />
`2001:0000::/32`) are classified as globally routable by IANA, so `is_global`<br />
returns `True` even when the embedded IPv4 targets a private, loopback, or<br />
cloud metadata destination. An attacker can register a webhook pointing at a<br />
hostname that resolves to a transition address to bypass the SSRF guard and<br />
exfiltrate vulnerability data to an internal endpoint.<br />
<br />
The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects<br />
<br />
organisation running the HEAD.
Impacto
Puntuación base 4.0
6.90
Gravedad 4.0
MEDIA