Wormhole.app EUVD-2026-91032

Exploitable when a Wormhole deployment (before 2026-08-22) exposes its coturn TURN server without restricting TCP relay peers - i.e. the TURN server permits TCP allocations/relays to arbitrary peer addresses rather than being limited to legitimate WebRTC peers. No authentication or user interaction is required (PR:N/UI:N), and it works against the affected default/misconfigured deployment. The main limiting factor is that impact depends on what the relay's network position can reach: the value of accessing 'instance metadata' is contingent on the relay running in a cloud environment that exposes a metadata service, and the connection-sourcing abuse is limited to TCP. Upgrading to the post-2026-08-22 build (which restricts relay peers) removes the condition.

This is a moderate-priority, not a top-tier, issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no attack requirements, which is the main driver of the 6.9 (Medium) score. However, impact is bounded: VC:L/VI:L and VA:N/SC:N/SI:N/SA:N indicate only limited confidentiality and integrity effects on the vulnerable system and explicitly no subsequent-system (scope) impact in the vendor scoring - meaning the practical payoff is reading cloud instance metadata and relaying/spoofing the source of TCP connections rather than full compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or widespread exploitation; the signals are consistent (medium severity, no exploitation evidence) rather than conflicting. One nuance worth verifying: SSRF (CWE-918) that reaches a cloud metadata endpoint can in practice escalate beyond the 'limited' impact the vendor assigned (e.g. harvesting IAM/credential metadata), so the VC:L rating may understate worst-case exposure depending on the hosting environment - confirm with the vendor what the TURN relay can actually reach. A patch is available from the vendor, which should be the primary remediation lever.

An unauthenticated attacker connects to the Wormhole coturn TURN server and, because TCP relay peers are not restricted, requests the server relay connections to an internal or cloud-metadata address (e.g. the 169.254.169.254 instance-metadata endpoint). The relay fetches that resource on the attacker's behalf, returning instance metadata or letting the attacker originate arbitrary TCP connections that appear to come from the trusted Wormhole relay IP. No public exploit was identified at time of analysis, but SSRF against TURN misconfigurations is well-understood and straightforward to reproduce.