Wormhole
Monthly
Wormhole.app deployments built before 2026-08-22 ship with a misconfigured coturn TURN server that fails to restrict TCP relay peers, allowing an unauthenticated remote attacker to pivot through the relay to reach internal resources such as cloud instance metadata or to source TCP connections from the relay's own IP address. Because the TURN endpoint is reachable over the network with no credentials or user interaction required (CVSS:4.0 base 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), impact is bounded by what the relay host's network position can reach - meaningful information disclosure and limited integrity impact rather than full compromise. This is a moderate-priority issue: it is not in CISA KEV and no public exploit code was identified at time of analysis, and the vendor has made a fixed build available.
Wormhole.app deployments built before 2026-08-22 ship with a misconfigured coturn TURN server that fails to restrict TCP relay peers, allowing an unauthenticated remote attacker to pivot through the relay to reach internal resources such as cloud instance metadata or to source TCP connections from the relay's own IP address. Because the TURN endpoint is reachable over the network with no credentials or user interaction required (CVSS:4.0 base 6.9; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), impact is bounded by what the relay host's network position can reach - meaningful information disclosure and limited integrity impact rather than full compromise. This is a moderate-priority issue: it is not in CISA KEV and no public exploit code was identified at time of analysis, and the vendor has made a fixed build available.