CVE-2026-86735: snipe-it before 8.7.0 SSRF via IPv6 transition address bypass
snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards and access internal services or cloud metadata endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snipe-itto a version that resolves this vulnerability.Fixed in 8.7.0 - Compensating control
Until upgraded, review and restrict super-admin capability to configure webhook URLs, since attackers with super-admin privileges can supply NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires super-admin privileges in Snipe-IT. The attacker must be able to configure a webhook URL.
What kind of target can an attacker reach through the bypass?
An attacker can use NAT64, 6to4, or Teredo IPv6 transition addresses that encode private IPv4 targets. This can enable requests to internal services or cloud metadata endpoints.
Which deployments are affected?
Snipe-IT versions before 8.7.0 are affected. The issue is in ExternalUrl validation used for webhook URLs.
What is the immediate mitigation if upgrading is not possible?
The provided information does not specify a workaround. Restrict super-admin access and review webhook URL configuration, particularly for NAT64, 6to4, and Teredo addresses.