Vulnerability Lookup CVE-2026-72761

The target must be running the unreleased HEAD version of vulnerability-lookup; no tagged release is vulnerable. The attacker must be able to register a webhook in the application - the CVSS 4.0 vector specifies PR:N (no privileges required), but whether anonymous webhook registration is permitted in a given deployment depends on site-specific access control configuration not described in the advisory; this should be verified against the actual deployment. The network path from the application server must support IPv6 or have a NAT64/6to4 gateway for the transition address to successfully forward to the intended private IPv4 target; on IPv4-only networks with no transition infrastructure, the embedded IPv4 may not be reachable, limiting practical exploitation. The target internal service must be reachable and return exploitable data via HTTP(S) from the application server.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N, score 6.9) signals a low-complexity, network-reachable, unauthenticated path with limited confidentiality impact on both the vulnerable system and reachable subsequent systems. In practice, real-world risk is substantially bounded by the deployment constraint: only organizations running the untagged HEAD branch are exposed, which is a small subset of an already niche user base. The SC:L metric reflects the SSRF's ability to reach internal services - a particularly sensitive concern for vulnerability-lookup deployments co-located with internal infrastructure or cloud services that expose metadata at 169.254.169.254. This is not in CISA KEV and no public exploit code has been identified, consistent with its narrow blast radius. EPSS data was not provided in the input and cannot be cited. The risk calculus for HEAD-running operators is elevated relative to the raw score because internal vulnerability data and cloud credentials are plausible exfiltration targets; for everyone else, this is a non-issue.

An attacker with access to webhook registration crafts a hostname under their control configured to resolve to the NAT64 address 64:ff9b::a9fe:a9fe, which encodes the AWS EC2 instance metadata IP 169.254.169.254. The Vulnerability Lookup server calls getaddrinfo, receives the NAT64 address, and passes the is_global check because the NAT64 prefix is globally routable per IANA. When the next vulnerability event fires the webhook, the application issues an outbound HTTP request that the NAT64 gateway translates to 169.254.169.254, and the metadata response - potentially including IAM role credentials - is forwarded to the attacker's endpoint.