CVE-2026-79659: Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfo
Ech0 before 4.7.3 contains a server-side request forgery vulnerability in the fetchPeerConnectInfo function that uses unvalidated HTTP requests instead of safe request methods with URL validation. Authenticated attackers can supply arbitrary URLs to access internal services and cloud metadata endpoints by triggering connection health checks or peer connection operations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to trigger connection health checks or peer connection operations that reach fetchPeerConnectInfo. The issue is remotely reachable and does not require user interaction.
What could an attacker access through the vulnerable requests?
An authenticated attacker can supply arbitrary URLs, allowing the server to make requests to internal services and cloud metadata endpoints. This can expose sensitive information available from systems reachable by the Ech0 server.
Which versions are affected?
Ech0 versions before 4.7.3 are affected. Upgrading to version 4.7.3 or later removes the affected version range described here.