CVE-2026-24902
Unknown Unknown - Not Provided
SSRF and Private Network Bypass in TrustTunnel VPN

Publication date: 2026-01-29

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description
TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In `tcp_forwarder.rs`, SSRF protection for `allow_private_network_connections = false` was only applied in the `TcpDestination::HostName(peer)` path. The `TcpDestination::Address(peer) => peer` path proceeded to `TcpStream::connect()` without equivalent checks (for example `is_global_ip`, `is_loopback`), allowing loopback/private targets to be reached by supplying a numeric IP. The vulnerability is fixed in version 0.9.114.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-29
Last Modified
2026-02-20
Generated
2026-05-07
AI Q&A
2026-01-30
EPSS Evaluated
2026-05-05
NVD
CVE-2026-24902
EUVD
EUVD-2026-4951
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
adguard trusttunnel to 0.9.114 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in TrustTunnel, an open-source VPN protocol, involves a server-side request forgery (SSRF) and bypass of private network restrictions in versions before 0.9.114. Specifically, the SSRF protection was only applied when connecting using hostnames, but not when connecting using numeric IP addresses. This allowed attackers to bypass restrictions and connect to loopback or private network addresses by supplying numeric IPs, potentially reaching internal network targets.


How can this vulnerability impact me? :

The vulnerability can allow an attacker to bypass private network restrictions and perform server-side request forgery attacks by connecting to internal or loopback network addresses. This could lead to unauthorized access to internal services or sensitive information within the private network, potentially compromising confidentiality and integrity.


What immediate steps should I take to mitigate this vulnerability?

Upgrade TrustTunnel to version 0.9.114 or later, where the vulnerability is fixed.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart