CVE-2026-63096: Dendrite SSRF Vulnerability

CVE-2026-63096 Overview

CVE-2026-63096 is a server-side request forgery (SSRF) vulnerability in Dendrite, a second-generation Matrix homeserver implementation. The flaw exists in the legacy media download endpoint /_matrix/media/r0/download and affects Dendrite versions through 0.13.8. Unauthenticated attackers can supply an unvalidated serverName parameter to coerce the server into opening outbound TLS connections to arbitrary hosts and ports. Distinguishable error response classes and internal IP addresses leaked in error messages enable blind port scanning and internal network topology enumeration. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can weaponize the Dendrite server as a proxy to probe internal network resources, enumerate reachable hosts, and map firewall-protected topology.

Affected Products

Dendrite Matrix homeserver versions through 0.13.8
Deployments exposing the legacy /_matrix/media/r0/download endpoint
Federated Matrix instances relying on Dendrite for media handling

Discovery Timeline

2026-07-17 - CVE-2026-63096 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-63096

Vulnerability Analysis

The vulnerability resides in the handling of the serverName path parameter on the legacy media download route. Dendrite accepts the value without validating whether it points to an internal address, private network range, or non-Matrix service port. When a request arrives, the server initiates an outbound TLS handshake against the attacker-supplied destination. This turns the homeserver into an SSRF pivot capable of reaching resources otherwise inaccessible from the public internet.

Because the endpoint requires no authentication, exploitation only requires network reachability to the Dendrite instance. The impact stays limited to confidentiality of network topology data, but that information is often sufficient to prepare follow-on attacks against internal services.

Root Cause

The root cause is missing input validation on the serverName parameter before it is passed to the outbound HTTP client. The legacy media endpoint fails to enforce an allowlist of federated Matrix servers, does not reject private or reserved IP ranges, and returns verbose error messages that disclose internal IP addresses and connection state.

Attack Vector

An attacker sends unauthenticated HTTP requests to the legacy media download endpoint with serverName values pointing at internal hosts and ports. The server's response timing and error class disclose whether the target is reachable, refuses the connection, or completes a TLS handshake. Iterating through address ranges and common ports yields a map of internal services. Leaked internal IP addresses in error strings further accelerate reconnaissance. Refer to the GitHub Unauthenticated SSRF Analysis and the VulnCheck Security Advisory on Dendrite for technical proof-of-concept details.

Detection Methods for CVE-2026-63096

Indicators of Compromise

Unauthenticated HTTP requests to /_matrix/media/r0/download/ with unusual or non-federated serverName values.
Outbound TLS connection attempts from the Dendrite host to RFC1918 addresses, localhost, or cloud metadata endpoints such as 169.254.169.254.
High-frequency requests from a single source iterating across sequential IP addresses or ports in the serverName field.
Error log entries referencing failed dials to internal hostnames that should never appear in federated media requests.

Detection Strategies

Inspect reverse proxy and Dendrite access logs for patterns of enumeration against the legacy media endpoint.
Correlate inbound requests to the media endpoint with outbound socket telemetry from the Dendrite host to identify SSRF pivoting.
Build alerts on failed outbound TLS handshakes originating from the Matrix service to private address space.

Monitoring Recommendations

Enable egress network flow logging on the Dendrite host and route it to a SIEM for retention and correlation.
Track anomalies in the ratio of legacy r0 media requests to modern v3 media requests, as attackers often target the legacy path.
Alert on any TLS connection from the homeserver to reserved, loopback, or link-local address ranges.

How to Mitigate CVE-2026-63096

Immediate Actions Required

Restrict access to the /_matrix/media/r0/download endpoint at the reverse proxy layer until an upstream patch is applied.
Block outbound traffic from the Dendrite host to internal networks, cloud metadata services, and reserved IP ranges using host or network firewall rules.
Audit historical access logs for prior exploitation attempts and confirm no reconnaissance succeeded against sensitive internal services.

Patch Information

At the time of publication, no vendor patch reference is included in the NVD entry. Monitor the VulnCheck Security Advisory on Dendrite and the upstream Dendrite project for a fixed release above version 0.13.8. Apply the fixed release as soon as it becomes available and validate that serverName input is rejected for private and reserved network destinations.

Workarounds

Terminate the legacy r0 media endpoint at the ingress layer and require clients to use the modern authenticated media API.
Deploy an egress proxy that enforces an allowlist of federated Matrix homeservers and denies connections to private IP ranges.
Configure the Dendrite deployment on a network segment without routes to sensitive internal systems or cloud metadata endpoints.
Strip verbose error messages at the reverse proxy to prevent leakage of internal IP addresses in responses.

bash

# Configuration example: nginx snippet to block the vulnerable legacy path
location ~ ^/_matrix/media/r0/download/ {
    return 404;
}