CVE-2026-82476: Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Memos deployments through 0.30.0 are exposed where the link-metadata fetcher can reach services in the 100.64.0.0/10 carrier-grade NAT range. This can include internal hosts and cloud metadata services using addresses in that range.
What does an attacker need to exploit this issue?
An attacker does not need authentication, user interaction, or special privileges. They need to cause the Memos link-metadata fetcher to request a target address in 100.64.0.0/10.
What information can be exposed?
The attacker can cause server-side requests to reachable targets in the omitted range and receive page titles and descriptions returned by the metadata fetcher. The provided information does not indicate exposure of full response bodies.