Skip to main content

Vulnerability Lookup EUVDEUVD-2026-55637

| CVE-2026-72761 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-10 CIRCL
SSRF Vulnerability Lookup
6.9
CVSS 4.0 · Vendor: CIRCL
Share

Severity by source

Vendor (CIRCL) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.8 MEDIUM

Network-reachable SSRF with no privileges per provided vector; scope changes to internal systems (S:C), with confidentiality-only impact from reading internal HTTP responses.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (CIRCL).

CVSS VectorVendor: CIRCL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Aug 10, 2026 - 15:18 vuln.today
Analysis Generated
Aug 10, 2026 - 15:18 vuln.today

DescriptionCVE.org

The webhook URL validator in website/notifications/webhooks.py uses ip.is_global to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32) are classified as globally routable by IANA, so is_global returns True even when the embedded IPv4 targets a private, loopback, or cloud metadata destination. An attacker can register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint.

The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects

organisation running the HEAD.

AnalysisAI

SSRF guard bypass in Vulnerability Lookup's webhook notification subsystem allows a network attacker to register a webhook URL whose hostname resolves to an IPv6 transition address (NAT64, 6to4, Teredo, or IPv4-mapped), causing the application to issue server-side requests to private, loopback, or cloud metadata endpoints that should be blocked. The flaw stems from relying solely on Python's is_global property, which correctly returns True for IANA-routable transition prefixes but fails to inspect the private IPv4 address embedded within them. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Register webhook with crafted NAT64/6to4 hostname
Delivery
DNS resolves to IPv6 transition address
Exploit
is_global check passes (IANA-routable prefix)
Execution
Application fires webhook on vulnerability event
Persist
NAT64 gateway translates to embedded private IPv4
Impact
Internal endpoint response exfiltrated to attacker
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target must be running the unreleased HEAD version of vulnerability-lookup; no tagged release is vulnerable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N, score 6.9) signals a low-complexity, network-reachable, unauthenticated path with limited confidentiality impact on both the vulnerable system and reachable subsequent systems. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with access to webhook registration crafts a hostname under their control configured to resolve to the NAT64 address `64:ff9b::a9fe:a9fe`, which encodes the AWS EC2 instance metadata IP 169.254.169.254. The Vulnerability Lookup server calls `getaddrinfo`, receives the NAT64 address, and passes the `is_global` check because the NAT64 prefix is globally routable per IANA. …
Remediation Organizations running the HEAD version of vulnerability-lookup should update to the latest HEAD commit, which incorporates the upstream fix at https://github.com/vulnerability-lookup/vulnerability-lookup/commit/f3e0c6899c5b3823dcfd860fc6cb3edbedc9bf65. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Vulnerability Lookup

View all
CVE-2026-73431 HIGH
8.8 Aug 12

Token replay in Vulnerability-Lookup's account activation and password-recovery mechanism allows an attacker who capture
CVE-2026-73374 MEDIUM
6.1 Aug 12

Stored cross-site scripting in Vulnerability-Lookup's render_tag_badges Jinja filter allows an authenticated user holdin
CVE-2026-73405 MEDIUM
5.3 Aug 12

Inconsistent authorization enforcement in Vulnerability-Lookup's SSE streaming interface allows self-registered but unco
CVE-2026-73432 MEDIUM
5.1 Aug 12

Server-side request forgery in Vulnerability-Lookup's remote-instance synchronization feature enables an authenticated a

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

EUVD-2026-55637 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy