Is there a public PoC exploit available for CVE-2026-63096?

Yes, a public proof-of-concept exploit is available for CVE-2026-63096. Prioritise patching immediately. EPSS: 0.2%.

Dendrite CVE-2026-63096

Q: What is the CVSS score of CVE-2026-63096?

CVE-2026-63096 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45194 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-17 VulnCheck

GHSA-jrcq-4ccj-6fr8

SSRF Dendrite Matrix Org

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.8 MEDIUM

PR:N confirmed by unauthenticated endpoint; S:C because SSRF reaches beyond Dendrite to probe internal systems; C:L for leaked internal network topology; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 16:19 vuln.today

CVE Published

Jul 17, 2026 - 15:30 cve.org

MEDIUM 6.9

DescriptionCVE.org

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.

AnalysisAI

Server-side request forgery in Dendrite through 0.13.8 allows unauthenticated remote attackers to weaponize the server as a port-scanning proxy against internal networks by supplying arbitrary host and port values via the unvalidated serverName parameter on the legacy media download endpoint. The server initiates outbound TLS connections to attacker-controlled destinations, and distinguishable error response classes combined with leaked internal IP addresses in error messages expose internal network topology. A publicly available proof-of-concept exploit exists; this vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Dendrite is the Go-language Matrix homeserver implementation maintained by matrix-org, designed as a lighter-weight alternative to the reference Synapse server. The Matrix federation protocol requires homeservers to fetch media from peer servers by name, and the legacy /_matrix/media/r0/download endpoint exposes a serverName parameter that is passed directly to Dendrite's outbound TLS dialing logic without allowlist validation or RFC-1918 filtering. This violates the trust boundary described by CWE-918 (Server-Side Request Forgery), where user-supplied input controls the server-side network destination. The affected CPE cpe:2.3:a:matrix-org:dendrite:*:*:*:*:*:*:*:* covers all releases through 0.13.8. The practical danger is amplified in cloud and container environments where internal metadata services (e.g., AWS Instance Metadata Service at 169.254.169.254) or other cluster-internal services are reachable from the Dendrite process's network namespace.

RemediationAI

No specific patched release version has been confirmed in the available data - patch availability per vendor advisory should be independently verified against the Dendrite GitHub release page before upgrading. As an immediate compensating control, block or restrict access to the /_matrix/media/r0/download path at the reverse proxy or WAF layer, ensuring only traffic from known federated Matrix homeservers can reach it; note this may break backwards compatibility with older Matrix clients relying on the legacy path. At the network layer, configure egress firewall rules on the Dendrite host to block outbound TCP connections to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16), which limits SSRF pivot capability while preserving legitimate federation traffic to public hosts. Validate serverName against a federation allowlist at the application layer if source-code patching is feasible. See https://www.vulncheck.com/advisories/dendrite-ssrf-via-unauthenticated-legacy-media-download-endpoint for advisory updates.