CVE-2026-73212: coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, goodpeeraddr() in src/server/nsturnserver.c uses ioaaddrinrange() in src/client/nsturnioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
coturnto a version that resolves this vulnerability.Fixed in 4.13.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73212?
CVE-2026-73212 has a risk rating of 58.
How do I fix CVE-2026-73212?
To mitigate CVE-2026-73212, update Coturn to version 4.13.1 or later.
What kind of attack does CVE-2026-73212 allow?
CVE-2026-73212 allows for an internal network server-side request forgery (SSRF) and potential remote code execution (RCE) due to address canonicalization issues.
Which versions of Coturn are affected by CVE-2026-73212?
CVE-2026-73212 affects Coturn versions prior to 4.13.1.
What is the impact of CVE-2026-73212 on insecure configurations?
CVE-2026-73212 can lead to unauthorized access and execution of code in systems with misconfigured peer IP access control lists.