CVE-2026-104458 Overview
CVE-2026-104458 is a server-side request forgery (SSRF) vulnerability in YesWiki versions before 4.6.7. The flaw resides in the validateKeyIdUrl() function, which fails to block IPv6 transition address formats. Unauthenticated attackers can bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. By submitting a crafted Signature keyId to the public actor inbox route, an attacker can force the YesWiki server to issue requests to cloud metadata endpoints, loopback services, or other internal hosts. The weakness is tracked under CWE-918.
Critical Impact
Unauthenticated attackers can reach internal services and cloud metadata endpoints from the YesWiki server, exposing credentials and internal infrastructure.
Affected Products
- YesWiki versions before 4.6.7
- Deployments exposing the ActivityPub actor inbox route
- YesWiki instances hosted in cloud environments with instance metadata services
Discovery Timeline
- 2026-10-02 - CVE-2026-104458 published to the National Vulnerability Database
- 2026-10-02 - Last updated in NVD database
Technical Details for CVE-2026-104458
Vulnerability Analysis
YesWiki implements an SSRF guard inside validateKeyIdUrl() to prevent the server from fetching URLs that resolve to private, loopback, or link-local addresses. The guard inspects the resolved IP against a blocklist of reserved ranges. However, the implementation does not account for IPv6 transition address formats that embed IPv4 addresses within an IPv6 representation.
An attacker supplies a URL whose hostname resolves to a 6to4 (2002::/16), NAT64 (64:ff9b::/96), or IPv4-compatible IPv6 (::ffff:0:0/96 and ::/96) address. The guard treats the address as a routable public IPv6 destination, while the underlying network stack may route the request to the embedded IPv4 target, including private ranges such as 169.254.169.254, 127.0.0.1, or RFC1918 networks.
Successful exploitation lets attackers query AWS, Azure, or GCP instance metadata services, probe internal management interfaces, and interact with loopback-bound services. The scope is limited to information retrieval from endpoints the YesWiki host can reach.
Root Cause
The root cause is incomplete address normalization in validateKeyIdUrl(). The function does not canonicalize IPv6 transition formats before comparing against the private-range deny list. This allows semantically-private destinations to pass validation.
Attack Vector
The attack is remote and unauthenticated. An attacker sends an HTTP POST request to the public ActivityPub actor inbox route, including a Signature header with a keyId pointing at an attacker-controlled hostname. The hostname resolves to a crafted IPv6 transition address that maps to an internal IPv4 destination. YesWiki then dereferences the keyId URL to fetch the signing key, routing the outbound request to the internal target.
The vulnerability is described in prose because no verified public exploit code is available. Technical details are documented in the GitHub Security Advisory GHSA-85f2-5r47-2pwm and the VulnCheck SSRF Bypass Advisory.
Detection Methods for CVE-2026-104458
Indicators of Compromise
- Inbound POST requests to the ActivityPub actor inbox route containing Signature headers with keyId values pointing at IPv6 literals or hostnames resolving to 2002::, 64:ff9b::, or ::ffff: prefixes.
- Outbound HTTP requests from the YesWiki host to cloud metadata addresses such as 169.254.169.254 or fd00:ec2::254.
- YesWiki process connections to loopback or RFC1918 destinations shortly after inbox requests.
Detection Strategies
- Inspect web server access logs for POSTs to the actor inbox route and extract the keyId host component for review.
- Monitor DNS resolver logs for YesWiki queries that return IPv6 transition addresses.
- Alert on egress connections from PHP or web server processes to metadata service IPs and internal management ports.
Monitoring Recommendations
- Capture and retain outbound network telemetry from YesWiki hosts, including destination IP and TLS SNI.
- Baseline normal ActivityPub federation traffic and flag deviations in keyId host patterns.
- Enforce egress logging at the host firewall or cloud VPC flow log layer for forensic review.
How to Mitigate CVE-2026-104458
Immediate Actions Required
- Upgrade YesWiki to version 4.6.7 or later across all instances.
- Block outbound access from YesWiki hosts to cloud metadata endpoints and internal management ranges at the network layer.
- Require IMDSv2 session tokens on AWS instances to blunt metadata abuse.
- Audit recent inbox requests for suspicious keyId values and investigate matching outbound connections.
Patch Information
The YesWiki maintainers released version 4.6.7, which hardens validateKeyIdUrl() to normalize and reject IPv6 transition addresses that map to private IPv4 ranges. Patch details are published in the GitHub Security Advisory GHSA-85f2-5r47-2pwm.
Workarounds
- Restrict the YesWiki host's egress firewall policy to deny traffic to 169.254.0.0/16, 127.0.0.0/8, RFC1918 ranges, and corresponding IPv6 equivalents.
- Disable or authenticate the ActivityPub actor inbox route if federation is not required.
- Place YesWiki behind an outbound proxy that enforces allow-listed destinations for federation callbacks.
# Configuration example
# Example iptables egress policy restricting YesWiki metadata access
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner www-data -d 2002::/16 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner www-data -d 64:ff9b::/96 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner www-data -d ::ffff:0:0/96 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
