CVE-2026-65968: ideon: Unauthenticated SSRF in /api/proxy/image via WHATWG bracketed/hex-mapped IPv6 bypass of isSafeUrl guard
ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new URL(url).hostname. Their IPv6 branch only recognises the textual forms ::1, fe80:/fc00:/fd00: prefixes, and the dotted-decimal IPv4-mapped form ::ffff:127.x. It does not recognise the WHATWG-canonical IPv4-mapped-IPv6 host that Node emits for a mapped address, which is hex-compressed and bracket-wrapped: [::ffff:7f00:1] for 127.0.0.1, [::ffff:a9fe:a9fe] for 169.254.169.254. An authenticated user who registers a STREAMABLEHTTP / SSE MCP server with URL http://[::ffff:7f00:1]:PORT/ (loopback) or http://[::ffff:a9fe:a9fe]/ (cloud metadata) passes both guards, and the server-side OAuth-discovery action then fetches that host, yielding server-side request forgery to loopback and to the cloud metadata service. This issue has been patched in version 0.9.4.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ideonto a version that resolves this vulnerability.Fixed in 0.9.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can register a STREAMABLE_HTTP or SSE MCP server can supply a crafted IPv4-mapped IPv6 URL. The OAuth-discovery action then causes the ideon server to fetch the supplied target.
Which internal services can be reached using the documented bypass?
The documented payloads can target loopback services through http://[::ffff:7f00:1]:PORT/ and a cloud metadata service through http://[::ffff:a9fe:a9fe]/. The affected validation checks fail to recognize these WHATWG-canonical bracketed, hex-compressed IPv4-mapped IPv6 forms.
What versions are affected, and what fixes the issue?
Versions prior to 0.9.4 are affected. Upgrade to version 0.9.4, which includes the patch.