CVE-2026-68507: ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass
ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 "any address" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ideonto a version that resolves this vulnerability.Fixed in 0.9.5
Event History
Frequently Asked Questions
Which deployments are exposed?
Self-hosted ideon deployments running versions before 0.9.5 are exposed if the /api/links/preview endpoint is reachable. The endpoint does not require authentication, so an unauthenticated remote caller can use it as a server-side URL-fetch relay.
What can an attacker do with the SSRF flaw?
An attacker can submit a URL to make the ideon server fetch it. The SSRF guard can be bypassed on Linux using the 0.0.0.0 or :: unspecified-address technique to reach the server's loopback interface.
Is a default login-protected deployment sufficient mitigation?
No. This route is explicitly behind no login check, so authentication does not protect the link-preview endpoint.
What should be done if upgrading is not immediately possible?
Restrict or disable access to /api/links/preview until the instance can be upgraded. Version 0.9.5 contains the patch.