CVE-2026-55473: HomeBox NAT64 SSRF Vulnerability

CVE-2026-55473 Overview

HomeBox is an open-source home inventory and organization system. Versions prior to 0.26.0 contain a Server-Side Request Forgery (SSRF) weakness [CWE-918] in the notifier URL validation logic located at backend/internal/sys/validate/notifier_url.go. The default-on BlockBogonNets and BlockCloudMetadata guards fail to inspect IPv4 addresses embedded inside the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. Authenticated users can submit a generic:// notifier through POST /v1/notifiers or POST /v1/notifiers/test and reach cloud metadata endpoints, localhost, or internal IPv4 hosts when the HomeBox instance egresses through NAT64/DNS64. The issue is fixed in version 0.26.0.

Critical Impact
Authenticated attackers can retrieve cloud instance metadata, including temporary credentials, by targeting internal IPv4 destinations through NAT64-translated IPv6 addresses.

Affected Products

HomeBox versions prior to 0.26.0
HomeBox deployments egressing through NAT64/DNS64 gateways
HomeBox instances running in cloud environments exposing metadata services (AWS, GCP, Azure)

Discovery Timeline

2026-09-21 - CVE-2026-55473 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-55473

Vulnerability Analysis

HomeBox integrates the Shoutrrr notification library to deliver alerts via user-defined notifiers. To prevent SSRF, the backend implements two default-on guards: BlockBogonNets rejects private and loopback ranges, and BlockCloudMetadata blocks known cloud metadata IPs such as 169.254.169.254. Both checks operate on the raw destination address of the notifier URL.

The checks do not decode IPv4-embedded IPv6 addresses defined by RFC 6052 (the well-known NAT64 prefix 64:ff9b::/96) or RFC 8215 (64:ff9b:1::/48). An authenticated user can craft a generic:// notifier pointing at an IPv6 address such as [64:ff9b::a9fe:a9fe], which encodes the IPv4 address 169.254.169.254. The validator classifies the IPv6 destination as safe and forwards the request.

On instances with NAT64/DNS64 egress, the gateway rewrites the IPv6 destination back to the embedded IPv4 target. The notifier test endpoint (POST /v1/notifiers/test) returns delivery result information, and Shoutrrr propagates the upstream response body, exposing metadata contents such as IAM session tokens to the caller.

Root Cause

The SSRF guard performs address classification on the literal destination without extracting IPv4 addresses embedded within RFC 6052 and RFC 8215 IPv6 prefixes. Any bogon or metadata IPv4 address can be encoded inside these prefixes and pass validation.

Attack Vector

An authenticated user submits a crafted notifier URL through the notifier creation or test API. The request requires low privileges and no user interaction. On NAT64-enabled deployments, the response body reveals data retrieved from internal services or cloud metadata endpoints.

// Patch: backend/internal/core/services/all.go
// Adds default DNS64/NAT64 prefixes to the notifier configuration so the SSRF
// guard can extract and validate the embedded IPv4 address.
func defaultNotifierConf() *config.NotifierConf {
    return &config.NotifierConf{
        BlockBogonNets:     true,                                       // default:true per conf tag
        BlockCloudMetadata: true,                                       // default:true per conf tag
        Dns64Nets:          []string{"64:ff9b::/96", "64:ff9b:1::/48"}, // default per conf tag
    }
}

Source: GitHub Commit 42c52f7

// Patch: backend/internal/sys/config/conf_notifier.go
// Dns64Nets lists the IPv6 prefixes used for DNS64/NAT64 translation (RFC 6052).
// IPv6 addresses inside these prefixes carry an embedded IPv4 address, which is
// extracted and checked against the allow/block rules above so DNS64 synthesis
// cannot be used to bypass them.
Dns64Nets []string `yaml:"dns64_nets" conf:"default:64:ff9b::/96;64:ff9b:1::/48,env:NOTIFIER_DNS64_NETS,flag:notifier-dns64-nets"`

Source: GitHub Commit 42c52f7

Detection Methods for CVE-2026-55473

Indicators of Compromise

Notifier records containing generic:// URLs with IPv6 destinations inside 64:ff9b::/96 or 64:ff9b:1::/48
HTTP requests to POST /v1/notifiers or POST /v1/notifiers/test with IPv6 hostnames encoding IPv4 metadata addresses (for example, [64:ff9b::a9fe:a9fe] representing 169.254.169.254)
Outbound connections from the HomeBox process to cloud metadata endpoints or internal RFC 1918 ranges following notifier submissions

Detection Strategies

Inspect application logs and reverse-proxy access logs for notifier API calls containing bracketed IPv6 literals with the NAT64 well-known prefixes
Correlate authenticated HomeBox API activity with unexpected egress to 169.254.169.254, metadata.google.internal, or private IPv4 subnets
Review the HomeBox database for stored notifier configurations referencing NAT64 prefixes and validate against the fixed configuration schema

Monitoring Recommendations

Enable egress logging on the NAT64 gateway and alert on translations targeting link-local, loopback, or RFC 1918 destinations initiated by the HomeBox host
Monitor cloud provider metadata service audit logs (IMDSv2 request logs on AWS, metadata access logs on GCP) for calls originating from the HomeBox workload identity
Track notifier test response sizes; large or unexpected response bodies delivered to authenticated users can indicate metadata exfiltration

How to Mitigate CVE-2026-55473

Immediate Actions Required

Upgrade HomeBox to version 0.26.0 or later, which introduces the Dns64Nets configuration and extracts embedded IPv4 addresses before validation
Audit existing notifiers in the HomeBox database and remove entries referencing IPv6 addresses inside 64:ff9b::/96 or 64:ff9b:1::/48
Rotate any cloud instance credentials that may have been exposed through the metadata service on affected deployments

Patch Information

The fix is available in HomeBox v0.26.0. The patch introduces a Dns64Nets configuration option (defaulting to the RFC 6052 and RFC 8215 prefixes) and updates the notifier URL validator to extract and re-check the embedded IPv4 address. Full technical details are documented in GHSA-r9pf-rg22-655m.

Workarounds

Restrict HomeBox egress at the network layer to block traffic to cloud metadata IPs (169.254.169.254, fd00:ec2::254) and internal IPv4 ranges
Disable NAT64/DNS64 for the HomeBox workload where feasible, which prevents the crafted IPv6 destinations from becoming routable
Limit HomeBox account creation and require administrator approval to reduce the pool of authenticated users able to submit notifiers

bash

# Configuration example (HomeBox v0.26.0+): override DNS64 prefix list if using a custom NAT64 deployment
export NOTIFIER_DNS64_NETS="64:ff9b::/96;64:ff9b:1::/48;2001:db8:64::/96"

# Verify defaults are enabled in config.yml
# notifier:
#   block_bogon_nets: true
#   block_cloud_metadata: true
#   dns64_nets:
#     - 64:ff9b::/96
#     - 64:ff9b:1::/48