HomeBox EUVD-2026-84037

Requires (1) an authenticated Homebox account with permission to create/test notifiers (PR:L), and (2) the specific deployment condition that the Homebox instance's outbound traffic egresses through a NAT64/DNS64 gateway - the description states that without NAT64 egress the crafted IPv6 destination is simply not routable, so the guard's misclassification cannot be weaponized. The attacker must craft an IPv6 destination inside the RFC 6052 prefix 64:ff9b::/96 or RFC 8215 prefix 64:ff9b:1::/48 embedding an internal IPv4 target (cloud metadata, localhost, or another internal host). Disclosure of retrieved data depends on using the notifier-test path, which returns delivery-result feedback that Shoutrrr propagates. Limiting factors: no unauthenticated access, and the non-default NAT64/DNS64 network topology is mandatory for any real impact.

This is a genuine but conditionally-gated SSRF (CWE-918) whose real-world risk is moderate, not critical. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N, score 6.0) is internally consistent and well-chosen: the AT:P (attack requirement present) metric correctly captures that exploitation only works when the Homebox instance egresses through a NAT64/DNS64 gateway, and PR:L reflects that an authenticated account is required. The description explicitly states 'Without NAT64 egress, the crafted IPv6 destination is not routable' - so the vulnerable network topology is the dominant risk gate, not the code flaw alone. Confidentiality-only impact (VC:H, VI:N/VA:N) is appropriate since the flaw discloses fetched metadata (e.g. temporary cloud credentials via the notifier-test response echoed through Shoutrrr) but does not directly grant write/DoS on Homebox itself. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no signal of active or widespread exploitation - this is a fix-during-normal-patching item, not an emergency. Note a minor divergence I would verify: I model the NAT64-egress prerequisite as AC:H in CVSS 3.1 (yielding ~6.8) whereas 4.0 expresses it as AT:P with AC:L; both are defensible and the numeric outcome is similar.

On a Homebox instance whose outbound traffic is routed via a NAT64/DNS64 gateway, an authenticated user creates a generic:// notifier pointing at an IPv6 address inside the 64:ff9b::/96 or 64:ff9b:1::/48 prefix that embeds an internal IPv4 target such as 169.254.169.254. When the attacker triggers POST /v1/notifiers/test, the SSRF guard wrongly classifies the destination as safe, the gateway translates it to the cloud metadata service, and the delivery-result feedback surfaced through Shoutrrr leaks the retrieved response - including temporary IAM credentials. No public exploit code was identified at time of analysis.