CVE-2026-73058
Received Received - Intake

SSRF Bypass via IPv6 Unspecified Address in StoaChat

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-73058
EUVD
EUVD-2026-59944

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stoatchat stoatchat to 0.15.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73058 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in StoaChat versions before 0.15.0. The flaw occurs because the application fails to block the IPv6 unspecified address (::) in its SSRF blocklist. Attackers can exploit this by crafting requests using IPv6 syntax to bypass protections via the /proxy and /embed endpoints, accessing internal services on the loopback interface and retrieving sensitive content.

Detection Guidance

To detect this vulnerability, check if your StoaChat instance is running a version before 0.15.0. Use commands like 'curl -s http://localhost:PORT/version' or inspect the application logs for version details. Test if the /proxy and /embed endpoints accept IPv6 unspecified addresses (::) by sending requests like 'curl -v http://[::]/' to these endpoints.

If the request succeeds or returns internal content, the system is likely vulnerable. Ensure your network monitoring tools can detect unusual outbound requests to loopback addresses via IPv6.

Impact Analysis

This vulnerability allows unauthenticated attackers to bypass SSRF protections and access internal services on the loopback interface. They can retrieve sensitive internal content, potentially exposing confidential data. The impact varies by deployment; in Docker setups, it may be limited to the container namespace, but host networking or loopback-bound services could worsen the issue.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by enabling unauthorized access to internal services and sensitive data through SSRF attacks. Unauthenticated attackers may retrieve internal content, which may include personal or protected health information, leading to breaches of confidentiality and regulatory requirements.

Mitigation Strategies

Immediately upgrade StoaChat to version 0.15.0 or later to patch the vulnerability. If upgrading is not possible, implement network-level restrictions to block outbound requests to loopback addresses (127.0.0.0/8 and ::1) from the application.

Disable or restrict access to the /proxy and /embed endpoints if they are not required. Monitor network traffic for suspicious SSRF attempts targeting loopback interfaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73058. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart