CVE-2026-85738

Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-85738

EUVD

EUVD-2026-86342

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability is a Server-Side Request Forgery (SSRF) guard bypass in the TREK application. The checkSsrf logic in server/src/utils/ssrfGuard.ts fails to recognize IPv6 transition addresses like NAT64, 6to4, or Teredo that embed IPv4 destinations. An attacker controlling a DNS record can supply a URL resolving to such an address, tricking the system into allowing requests to private, loopback, or link-local IPv4 targets. This bypasses SSRF protections and may expose internal services or cloud metadata.

Detection Guidance

To detect this vulnerability, check if your TREK instance is running a version prior to 3.4.0. Inspect DNS records for AAAA entries pointing to NAT64 (64:ff9b::/96), 6to4 (2002::/16), or Teredo (2001:0000::/32) addresses embedding private IPv4 targets. Monitor network traffic for outbound connections to these transition addresses.

Impact Analysis

An attacker could exploit this to reach internal services, cloud metadata endpoints (like AWS instance identity tokens), or other private resources. This may lead to credential theft, internal network scanning, or data exfiltration. Features like Google Maps imports, webhooks, or integrations could be abused to access sensitive systems if NAT64 or similar transition addresses are supported in the environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Unauthorized data exfiltration or exposure of internal systems may result in compliance breaches, fines, or legal consequences depending on the affected systems and data.

Mitigation Strategies

Upgrade TREK to version 3.4.0 or later immediately. Review and restrict DNS records to prevent AAAA entries resolving to IPv6 transition addresses. Disable NAT64, 6to4, or Teredo routing if not required. Audit plugin egress policies to ensure they enforce strict host validation.

Hi! I’m here to help you understand CVE-2026-85738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70