CVE-2026-63306: stoatchat SSRF Vulnerability

CVE-2026-63306 Overview

CVE-2026-63306 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in stoatchat versions prior to 0.13.5. The /proxy and /embed endpoints accept arbitrary URLs without performing DNS resolution filtering or private IP range validation. Attackers can supply malicious URLs or redirect chains to force the stoatchat server to issue requests against internal infrastructure. This enables enumeration of internal services, application fingerprinting, and access to cloud instance metadata endpoints. The flaw is exploitable over the network with no authentication or user interaction, and it maps to CWE-918.

Critical Impact
Unauthenticated remote attackers can pivot through the stoatchat server to reach internal services and cloud metadata endpoints, exposing credentials and sensitive infrastructure.

Affected Products

stoatchat versions prior to 0.13.5
Deployments exposing the /proxy HTTP endpoint
Deployments exposing the /embed HTTP endpoint

Discovery Timeline

2026-07-16 - CVE-2026-63306 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-63306

Vulnerability Analysis

The vulnerability resides in two HTTP handlers exposed by stoatchat: /proxy and /embed. Both endpoints accept a URL parameter and issue an outbound HTTP request from the server. Neither endpoint requires authentication. Neither endpoint validates the destination host against private, loopback, link-local, or reserved IP ranges. An attacker submits a crafted URL and the server-side fetcher connects to the target, returning response data or observable side effects to the caller.

Because the fetcher performs DNS resolution at request time and follows redirects without re-validation, attackers can bypass naive hostname allowlists using DNS entries that resolve to internal addresses or by chaining an external redirect to an internal target. This is a classic SSRF pattern classified under CWE-918: Server-Side Request Forgery.

Root Cause

The root cause is missing input validation on user-supplied URLs prior to outbound request execution. The proxy logic does not:

Resolve the hostname and reject responses that map to RFC 1918, loopback (127.0.0.0/8), or link-local (169.254.0.0/16) ranges.
Re-check the destination host after HTTP redirects.
Restrict URL schemes to a safe allowlist such as https.
Require authentication before initiating outbound fetches.

Attack Vector

An unauthenticated attacker sends a request to the vulnerable endpoint with a target URL pointing at an internal resource. Common exploitation targets include the AWS metadata service at 169.254.169.254, Kubernetes API endpoints on the local network, and unauthenticated internal admin panels. Redirect chains hosted on attacker-controlled infrastructure defeat basic hostname filters when only the initial URL is inspected. See the GitHub Security Advisory GHSA-xhww-5g9p-vvq5 and the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-63306

Indicators of Compromise

Requests to /proxy or /embed endpoints containing URL parameters referencing 127.0.0.1, localhost, 169.254.169.254, or RFC 1918 address ranges.
Outbound connections from the stoatchat host to internal-only services with no legitimate business relationship.
Repeated /proxy or /embed requests iterating through internal IP ranges or common service ports, indicating enumeration.
HTTP responses from stoatchat containing cloud instance metadata fields such as iam credentials or instance-identity documents.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect URL parameters on /proxy and /embed and block requests targeting private, loopback, and metadata addresses.
Alert on egress traffic from the stoatchat server that terminates on internal subnets or cloud metadata endpoints.
Correlate access logs for high-volume requests to the affected endpoints from a single source IP against a short time window.

Monitoring Recommendations

Enable verbose access logging on stoatchat and forward logs to a centralized SIEM for retention and query.
Monitor cloud provider audit logs for API calls originating from the stoatchat instance role that fall outside its normal behavior baseline.
Track DNS queries from the stoatchat host and alert on resolutions to internal or metadata hostnames initiated by the application process.

How to Mitigate CVE-2026-63306

Immediate Actions Required

Upgrade stoatchat to version 0.13.5 or later, which addresses the SSRF flaw in the /proxy and /embed handlers.
Restrict network egress from the stoatchat host to only the external destinations required for legitimate operation.
Block access to cloud instance metadata services from the stoatchat host, or enforce IMDSv2 with hop-limit 1 on AWS deployments.
Place authentication in front of /proxy and /embed if the endpoints must remain reachable during the upgrade window.

Patch Information

Upgrade to stoatchat 0.13.5 or later. Consult the GitHub Security Advisory GHSA-xhww-5g9p-vvq5 for the fix commit and release notes. Verify the deployed version after upgrade and restart the service to load the patched handlers.

Workarounds

Deploy a reverse proxy or WAF rule that rejects requests to /proxy and /embed containing private, loopback, link-local, or metadata IP addresses.
Configure host-level egress firewall rules that deny outbound traffic from the stoatchat process to RFC 1918 ranges and 169.254.169.254.
Disable the /proxy and /embed endpoints at the ingress layer if the features are not required.

bash

# Example iptables egress restriction for the stoatchat host
iptables -A OUTPUT -m owner --uid-owner stoatchat -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner stoatchat -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner stoatchat -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner stoatchat -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner stoatchat -d 127.0.0.0/8 -j REJECT