CVE-2026-72761
Received Received - Intake

IPv6 Transition Address Bypass in Webhook Validator

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 5a6e4751-2f3f-4070-9419-94fb35b644e8

Description
The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns `True` even when the embedded IPv4 targets a private, loopback, or cloud metadata destination. An attacker can register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint. The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects organisation running the HEAD.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72761
EUVD
EUVD-2026-55637

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a webhook URL validator that incorrectly allows IPv6 transition addresses (like NAT64, 6to4, or Teredo) to bypass SSRF protections. The validator uses ip.is_global to check if an address is public, but these transition addresses are marked as globally routable by IANA even if they embed private IPv4 addresses. Attackers can exploit this to register webhooks pointing to internal endpoints and exfiltrate data.

Detection Guidance

Check webhook configurations for URLs resolving to IPv6 transition addresses like NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001::/32). Inspect DNS logs for suspicious hostnames pointing to these ranges.

Impact Analysis

If you run a vulnerable version of the software, an attacker could exploit this to send data to internal systems you did not intend, potentially leaking sensitive information. The impact is limited to non-release versions, as the fix is already applied in the current HEAD.

Mitigation Strategies

Update to the latest HEAD version where the fix is applied. If using a non-release version, manually patch the webhook URL validator in website/notifications/webhooks.py to properly handle IPv6 transition addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72761. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart