EUVD-2026-69788
GHSA-qx8f-9cjx-54j9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF with no auth or interaction; scope changes as requests cross to internal Azure/cloud metadata systems, yielding limited confidentiality impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
4DescriptionCVE.org
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.
AnalysisAI
Server-side request forgery in Mailpit's link-checking and proxy functionality allows unauthenticated remote attackers to bypass the IsInternalIP deny list and reach restricted internal network destinations. The deny list in net.go failed to include the Azure WireServer address (168.63.129.16/32) and the RFC 2765/6145 IPv4-translated IPv6 prefix (::ffff:0:0:0/96), enabling DNS rebinding-style attacks where attacker-controlled hostnames resolve to these unblocked addresses. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Mailpit's link-check API or HTTP proxy endpoint to be reachable by the attacker - either because Mailpit is exposed to the internet or because the attacker has access to the network segment hosting Mailpit (e.g., via a compromised internal host or malicious email from a trusted sender). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L) accurately reflects the principal risk: unauthenticated network access with low confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Mailpit to v1.31.0 or later, which includes the deny-list fix in commit a02821bf3424da9196e156c422370f4868a1dff2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today