CVE-2026-126799

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...

EUVD-2026-124014

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...

CVE-2026-126799 Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...

CVE-2026-126799

Gotenberg versions 8.31.0 before 8.38.0 are vulnerable to a Server-Side Request Forgery (SSRF) in the IsPublicIP() function. The root cause is the ability for unauthenticated attackers to bypass private-IP deny-list protections by using IPv6 zone identifiers (e.g., appending %25eth0). Attackers c...

CVE-2026-126799

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...

CVE-2026-126799 Gotenberg 8.31.0 before 8.38.0 SSRF via IPv6 Zone Identifiers in IsPublicIP

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...

CVE-2026-126799: gotenberg: Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP() that allows…

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...

PT-2026-145456

Gotenberg 8.31.0 before 8.38.0 contains a server-side request forgery vulnerability in IsPublicIP that allows unauthenticated attackers to bypass private-IP deny-list protections using IPv6 zone identifiers. Attackers can append a zone such as %25eth0 to the unspecified address or blocked IPv6...

CVE-2026-63441 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

CVE-2026-63441

The 2FAuth web application (versions 6.1.0 until 8.0.0 ) is vulnerable to a Server-Side Request Forgery (SSRF) due to a flaw in the App\Services\Traits\ValidatesUrls::isPublicIp() method. This component fails to recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes. Consequently, an otpaut...

CVE-2026-63441 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

EUVD-2026-118489

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

CVE-2026-63441 2FAuth: SSRF guard misses IPv6 NAT64 prefixes, allowing image fetch to reach internal/metadata targets

2FAuth is a web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6...

SUSE CVE-2026-55245

Bifrost is an enterprise AI gateway for routing requests to model providers. Prior to 1.5.17, the isPublicIP function in core/providers/utils/fetch.go, reached through FetchAndEncodeURL for Bedrock and Vertex image or document URLs, classifies Carrier-Grade NAT 100.64.0.0/10, IPv6 6to4 2002::/16,...

CVE-2026-85692

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

CVE-2026-85692 Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

CVE-2026-85692

Nightingale (n9e) contains an SSRF guard bypass in the isPublicIP function within aiagent/tools/http.go, the SSRF protection for the http_fetch AI-agent tool. The function only unwraps standard IPv4-mapped (::ffff:a.b.c.d) IPv6 addresses before checking them against a forbidden-range list, failin...

EUVD-2026-71141

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

CVE-2026-85692 Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the httpfetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...

PT-2026-85578

Nightingale n9e, as of commit 8362cbe main branch, confirmed 2026-08-27, contains a server-side request forgery vulnerability in the isPublicIP function in aiagent/tools/http.go, the SSRF guard for the http fetch AI-agent tool. The function only unwraps standard IPv4-mapped ::ffff:a.b.c.d IPv6...