CVE-2026-55473
Received Received - Intake

SSRF via NAT64 Prefix in HomeBox Notifier

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifier_url.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An authenticated user can submit a generic:// notifier through POST /v1/notifiers or POST /v1/notifiers/test, and on a Homebox instance that egresses through NAT64/DNS64, the gateway can translate an accepted IPv6 destination to cloud metadata, localhost, or another internal IPv4 host. The notifier test path returns delivery result information, and Shoutrrr propagates the response, providing feedback that can disclose retrieved metadata such as temporary credentials. Without NAT64 egress, the crafted IPv6 destination is not routable, but the guard still incorrectly classifies it as safe. This issue is fixed in version 0.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-55473
EUVD
EUVD-2026-84037

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sysadminsmedia homebox to 0.26.0 (exc)
sysadminsmedia homebox 0.25.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) flaw in Homebox versions prior to 0.26.0. The SSRF guard is designed to block unsafe IPv6 ranges and cloud metadata IPs but fails to check NAT64 transition prefixes (64:ff9b::/96 and 64:ff9b:1::/48). An authenticated user can exploit this by submitting a crafted generic:// notifier URL with an IPv6 address embedding an IPv4 destination. When the system uses NAT64/DNS64 egress, the IPv6 address is translated to the embedded IPv4 address, bypassing security controls and allowing access to cloud metadata, localhost, or internal hosts.

Detection Guidance

To detect this vulnerability, check if your Homebox instance is running a version prior to 0.26.0. Use commands like 'curl -s https://your-homebox-instance.com/api/version' or inspect the running container/image tags. If NAT64/DNS64 is used, test if crafted IPv6 addresses like generic://[64:ff9b:1::a9fe:a9fe]/ are accepted by the notifier endpoints.

Impact Analysis

An authenticated attacker could exploit this to perform SSRF attacks, accessing internal services, exfiltrating sensitive data, or retrieving temporary cloud credentials via metadata endpoints. Without NAT64 egress, the attack is not feasible as the crafted IPv6 address remains unrouteable. The impact is limited to environments using NAT64/DNS64 translation.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of temporary credentials or internal service interactions may result in compliance breaches, data leaks, or unauthorized system access, depending on the exploited resources.

Mitigation Strategies

Upgrade Homebox to version 0.26.0 or later immediately. If upgrading is not possible, disable the notifier SSRF protections or restrict access to POST /v1/notifiers and POST /v1/notifiers/test endpoints. Ensure NAT64/DNS64 prefixes are properly configured in the new version to validate embedded IPv4 addresses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55473. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart