mistral.rs CVE-2026-108939

Exploitation requires that the mistral.rs server exposes the media-source fetching feature (media_source.rs) which retrieves attacker-influenced remote URLs/addresses, with the reject_private_ip SSRF guard relied upon to block internal targets. The specific condition is supplying an IPv6 transition-address form that embeds an internal IPv4 - IPv4-mapped (::ffff:), IPv4-compatible (::x), 6to4 (2002::), or NAT64 (64:ff9b::) - which the pre-0.9.4 is_global_ip logic failed to decode, so the private/internal IP is treated as global and fetched. Limiting factors: the deployment must actually use remote media-URL fetching and be positioned where reachable internal services exist (e.g. cloud metadata, loopback, link-local); impact is limited to low confidentiality (internal response retrieval/probing), with no integrity or availability impact. No authentication is required per CVSS PR:N.

This is a moderate, credible-but-not-urgent issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but impact is deliberately scoped low: only VC:L with VI:N/VA:N and no subsequent-system impact (SC/SI/SA:N), reflecting that this SSRF primarily enables internal-service probing / limited read rather than full compromise. Exploit maturity is E:P (Proof-of-Concept), consistent with the description's statement that the exploit was publicly disclosed - so publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score in the provided data, so real-world exploitation volume cannot be quantified. There is no SSVC decision data supplied. The signals are internally consistent (network vector matches an HTTP media-fetch SSRF; low confidentiality impact matches a filter-bypass that reaches internal addresses), so no contradiction needs flagging - the main caveat is that severity is capped by the limited technical impact and by the requirement that the target actually use the media-URL fetching feature. Treat as a prioritized patch for exposed mistral.rs deployments that accept remote media URLs, not a drop-everything emergency.

An attacker sends a request to a mistral.rs server's media-fetching feature supplying an IPv6 transition address (e.g. 64:ff9b::a9fe:a9fe NAT64, 2002:7f00:1:: 6to4, or ::7f00:1 IPv4-compatible) that embeds an internal IPv4 such as 127.0.0.1 or 169.254.169.254. Because is_global_ip/reject_private_ip did not decode these embedded-IPv4 forms, the SSRF filter is bypassed and the server fetches from internal endpoints (e.g. cloud metadata). A public proof-of-concept exploit has been disclosed (CVSS E:P).