CVE-2026-24902
Unknown Unknown - Not Provided
SSRF and Private Network Bypass in TrustTunnel VPN

Publication date: 2026-01-29

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description
TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In `tcp_forwarder.rs`, SSRF protection for `allow_private_network_connections = false` was only applied in the `TcpDestination::HostName(peer)` path. The `TcpDestination::Address(peer) => peer` path proceeded to `TcpStream::connect()` without equivalent checks (for example `is_global_ip`, `is_loopback`), allowing loopback/private targets to be reached by supplying a numeric IP. The vulnerability is fixed in version 0.9.114.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-29
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-01-30
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24902
EUVD
EUVD-2026-4951
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
adguard trusttunnel to 0.9.114 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in TrustTunnel, an open-source VPN protocol, involves a server-side request forgery (SSRF) and bypass of private network restrictions in versions before 0.9.114. Specifically, the SSRF protection was only applied when connecting using hostnames, but not when connecting using numeric IP addresses. This allowed attackers to bypass restrictions and connect to loopback or private network addresses by supplying numeric IPs, potentially reaching internal network targets.

Impact Analysis

The vulnerability can allow an attacker to bypass private network restrictions and perform server-side request forgery attacks by connecting to internal or loopback network addresses. This could lead to unauthorized access to internal services or sensitive information within the private network, potentially compromising confidentiality and integrity.

Mitigation Strategies

Upgrade TrustTunnel to version 0.9.114 or later, where the vulnerability is fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24902. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart