GHSA-qx8f-9cjx-54j9MediumCVSS 5.3
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129...
🔗 CVE IDs covered (1)
📋 Description
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-84697
- https://github.com/axllent/mailpit/commit/a02821bf3424da9196e156c422370f4868a1dff2
- https://github.com/axllent/mailpit
- https://github.com/axllent/mailpit/blob/v1.31.0/internal/tools/net.go
- https://www.vulncheck.com/advisories/mailpit-ssrf-deny-list-bypass-via-azure-metadata-and-ipv6-prefix
- https://github.com/advisories/GHSA-qx8f-9cjx-54j9