Ech0 CVE-2026-79659

Exploitation requires a valid, authenticated Ech0 user session with a bearer token (CVSS PR:L) - the attacker must possess a legitimate account or have stolen a session token; no administrative privileges are needed. The vulnerability is triggered through two distinct code paths: (1) creating or updating a peer connection record with a malicious connect_url value and subsequently invoking the connection health-check API (/api/connects/health), or (2) any peer-connection operation that calls fetchPeerConnectInfo at line 307 or 498 of connect.go. The SSRF yields its highest impact when Ech0 is deployed in cloud environments (AWS EC2, GCP, Kubernetes) where the link-local metadata service address 169.254.169.254 is reachable from the host network namespace. On-premises deployments without cloud metadata services remain vulnerable to internal network probing and service enumeration but face reduced credential-exfiltration impact. No non-default Ech0 configuration is required; a default installation with at least one user account is sufficient.

The CVSS 4.0 base score of 8.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N) accurately represents the threat profile. Authentication (PR:L) provides a meaningful barrier, limiting exposure to account compromise scenarios or insider threats; however, if Ech0 permits open self-registration, this barrier is minimal in practice. The SC:H (Subsequent System Confidentiality: High) metric is warranted because the most impactful reachable targets are cloud provider metadata services - AWS IMDSv1 at 169.254.169.254 and GCP metadata - as well as Kubernetes API servers, which can yield IAM role credentials granting broad cloud-environment control far beyond the Ech0 application itself. No EPSS score was provided in the source data, and CISA KEV confirmation of active exploitation is absent; these signals cannot be assessed. A public PoC is included in the vendor GHSA advisory, which materially lowers the exploitation barrier. For cloud-hosted Ech0 instances, real-world risk is high; for on-premises deployments without accessible metadata services, the practical impact is reduced to internal network enumeration and lateral movement.

An authenticated attacker creates a peer connection record in Ech0 with connect_url set to http://169.254.169.254/latest/meta-data/iam/security-credentials/ and then calls the health-check API endpoint, causing the Ech0 server to fetch the AWS instance metadata URL and return IAM role credentials in the response body. A working proof-of-concept for both AWS IMDSv1 and Kubernetes API enumeration is publicly available in the GHSA advisory GHSA-8mc6-xjpr-h98x, requiring only a valid bearer token.