Ech0 SSRF via Unvalidated HTTP Requests Before 4.7.3

Executive Summary

CVE-2026-79659 is a Server-Side Request Forgery (SSRF) vulnerability in the Ech0 project affecting versions before 4.7.3. The flaw exists in the fetchPeerConnectInfo function which uses unvalidated HTTP requests instead of safe methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services or cloud metadata endpoints by triggering connection health checks or peer connection operations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Ech0 instance is running a version before 4.7.3. Use commands like 'ech0 version' or inspect the running process to verify the version. Monitor network logs for unusual outbound requests from the Ech0 service to internal or cloud metadata endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated attackers to access internal services, cloud metadata endpoints (like AWS IMDSv1 or GKE metadata), or Kubernetes API endpoints. It can lead to confidentiality breaches as attackers may retrieve sensitive data from internal systems or cloud services. The impact is significant due to low privilege requirements and no need for user interaction.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. A breach could result in regulatory penalties, loss of customer trust, and legal consequences due to unauthorized data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ech0 to version 4.7.3 or later immediately. If upgrading is not possible, restrict network access to the Ech0 service to prevent unauthorized outbound requests. Review and block any suspicious outbound connections from the Ech0 service to internal or cloud metadata endpoints.

Useful 0 Not Useful 0