CVE-2026-100355: Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. RestrictedHTTP::PrivateNetworkGuard relied on Ruby's IPAddr#private? IPAddr#loopback?, and IPAddr#linklocal? predicates plus IPv4-mapped and IPv4-compatible checks, which do not cover several special-use ranges. An authenticated user can post a link to a hostname resolving to CGNAT 100.64.0.0/10, NAT64 64:ff9b::/96 or 64:ff9b:1::/48, or 6to4 2002::/16 to bypass the guard and cause server-side requests to internal network resources. The NAT64 and 6to4 ranges can embed an internal IPv4 target. Confidentiality impact is limited to returned OpenGraph metadata, and most internal endpoints return none. There is no integrity or availability impact. An initial fix was released in version 1.4.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Campfireto a version that resolves this vulnerability.Fixed in 1.4.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Campfire user who can post a message containing a link can trigger the server-side fetch. Exploitation also depends on using a hostname that resolves to one of the uncovered special-use ranges and reaching an internal resource from the Campfire server.
Which destinations can bypass the private-network guard?
The incomplete denylist permits destinations in CGNAT 100.64.0.0/10, NAT64 64:ff9b::/96 and 64:ff9b:1::/48, and 6to4 2002::/16. NAT64 and 6to4 addresses can embed an internal IPv4 target.
What information can be exposed through a successful request?
Exposure is limited to OpenGraph metadata returned by the requested internal resource. Most internal endpoints return no such metadata, and the issue has no stated integrity or availability impact.
What version contains the initial fix?
An initial fix was released in Campfire version 1.4.5. Versions 1.4.4 and earlier are described as affected.