CVE-2026-100251: Wormhole.app SSRF
Published Oct 1, 2026
·Updated
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.
Affected Software
1 affected component
Wormhole.app Wormhole.app
Event History
Oct 1, 2026
CVE Published
via MITRE·07:44 PM
Data Sourced
via MITRE·07:44 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates that exploitation can be performed over the network with low attack complexity, without privileges or user interaction.
2
What can an attacker do through the exposed relay?
An attacker may access instance metadata or establish TCP connections that appear to originate from the Wormhole relay's IP address.
3
Which deployments are affected?
Deployments made before 2026-08-22 are affected when the coturn TURN server does not properly restrict TCP relay peers.