CVE-2026-73058: stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass
stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
stoatchatto a version that resolves this vulnerability.Fixed in 0.15.0 - Compensating control
Until all instances are upgraded to 0.15.0, block requests that use the IPv6 unspecified address (::) from reaching the /proxy and /embed endpoints (do not rely solely on the application's SSRF blocklist for this case).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73058?
The severity of CVE-2026-73058 is medium with a score of 5.8.
How do I fix CVE-2026-73058?
To fix CVE-2026-73058, upgrade to stoatchat version 0.15.0 or later.
What exploitation vector is relevant for CVE-2026-73058?
CVE-2026-73058 allows attackers to exploit the vulnerability through the /proxy and /embed endpoints without authentication.
What type of vulnerability is CVE-2026-73058?
CVE-2026-73058 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What conditions must be met to exploit CVE-2026-73058?
An attacker must craft requests using IPv6 literal syntax to exploit CVE-2026-73058.