CVE-2026-72761: Webhook SSRF guard bypassed by IPv6 transition addresses (NAT64/6to4/Teredo pass is_global check) in vulnerability-lookup
The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32) are classified as globally routable by IANA, so isglobal returns True even when the embedded IPv4 targets a private, loopback, or cloud metadata destination. An attacker can register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint.
The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects
organisation running the HEAD.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72761?
The severity of CVE-2026-72761 is rated at risk level 44.
How does CVE-2026-72761 affect webhook URL validation?
CVE-2026-72761 allows bypassing the webhook URL validator due to misclassification of IPv6 transition addresses as globally routable.
What types of IPv6 addresses are involved in CVE-2026-72761?
CVE-2026-72761 involves IPv6 transition addresses such as NAT64, 6to4, and Teredo.
How can I fix CVE-2026-72761?
To fix CVE-2026-72761, update the webhook URL validator to correctly validate IPv6 addresses and prevent the bypass.
What is the impact of exploiting CVE-2026-72761?
Exploiting CVE-2026-72761 can lead to unauthorized access to internal resources via SSRF attacks.