CVE-2026-24902

Unknown Unknown - Not Provided

SSRF and Private Network Bypass in TrustTunnel VPN

Publication date: 2026-01-29

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description

TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In `tcp_forwarder.rs`, SSRF protection for `allow_private_network_connections = false` was only applied in the `TcpDestination::HostName(peer)` path. The `TcpDestination::Address(peer) => peer` path proceeded to `TcpStream::connect()` without equivalent checks (for example `is_global_ip`, `is_loopback`), allowing loopback/private targets to be reached by supplying a numeric IP. The vulnerability is fixed in version 0.9.114.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-29

Last Modified

2026-02-20

Generated

2026-07-06

AI Q&A

2026-01-30

EPSS Evaluated

2026-07-05

NVD

CVE-2026-24902

EUVD

EUVD-2026-4951

Affected Vendors & Products

Vendor	Product	Version / Range
adguard	trusttunnel	to 0.9.114 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability in TrustTunnel, an open-source VPN protocol, involves a server-side request forgery (SSRF) and bypass of private network restrictions in versions before 0.9.114. Specifically, the SSRF protection was only applied when connecting using hostnames, but not when connecting using numeric IP addresses. This allowed attackers to bypass restrictions and connect to loopback or private network addresses by supplying numeric IPs, potentially reaching internal network targets.

Impact Analysis

The vulnerability can allow an attacker to bypass private network restrictions and perform server-side request forgery attacks by connecting to internal or loopback network addresses. This could lead to unauthorized access to internal services or sensitive information within the private network, potentially compromising confidentiality and integrity.

Mitigation Strategies

Upgrade TrustTunnel to version 0.9.114 or later, where the vulnerability is fixed.

Hi! I’m here to help you understand CVE-2026-24902. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70