CVE-2026-88896: EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPTRESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EspoCRMto a version that resolves this vulnerability.Fixed in 10.0.4 - Compensating control
Restrict or block outbound access from EspoCRM to internal/private network services (e.g., via egress firewall rules/allowlist) to mitigate SSRF exploitation using IPv6 transition addresses (NAT64 64:ff9b::, 6to4 2002::, Teredo 2001:0000::) that bypass HostCheck::ipAddressIsNotInternal and the CURLOPT_RESOLVE IP-pinning check.
Event History
Frequently Asked Questions
Which users or features can be used to trigger the vulnerable outbound request?
Any authenticated user with attachment access can reach POST /Attachment/fromImageUrl. Outbound webhook delivery is also affected, but triggering it requires an administrator or API user.
What does an attacker need to bypass the outbound URL validation?
The attacker needs control of a domain whose AAAA record resolves to an IPv6 transition address embedding a private IPv4 address, such as NAT64, 6to4, or Teredo. These addresses bypass the internal-host validation and CURLOPT_RESOLVE IP-pinning check.
What internal targets can be reached if exploitation succeeds?
EspoCRM can be induced to issue outbound requests to internal network services. The provided information does not identify specific services or ports.