CVE-2026-72761: Webhook URL Validator SSRF Vulnerability

CVE-2026-72761 Overview

CVE-2026-72761 is a Server-Side Request Forgery (SSRF) vulnerability in the Vulnerability Lookup project. The flaw resides in the webhook URL validator located at website/notifications/webhooks.py. The validator relies on Python's ip.is_global attribute to reject non-public destinations after DNS resolution. IPv6 transition addresses such as NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001:0000::/32) are classified as globally routable by IANA, so is_global returns True even when the embedded IPv4 targets a private, loopback, or cloud metadata endpoint. The issue was introduced on a non-release version and only affects organizations running HEAD.

Critical Impact
An attacker with webhook registration privileges can bypass the SSRF guard and exfiltrate vulnerability data to internal endpoints, including cloud metadata services.

Affected Products

Vulnerability Lookup (HEAD builds prior to commit f3e0c68)
website/notifications/webhooks.py webhook validator component
Deployments running non-release/development branches

Discovery Timeline

2026-08-10 - CVE-2026-72761 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72761

Vulnerability Analysis

The webhook validator resolves user-supplied URLs to IP addresses and then checks ipaddress.ip_address(...).is_global to enforce a public-only policy. This check is insufficient because Python's is_global treats IPv6 transition ranges as globally routable per IANA classification. On NAT64, 6to4, or Teredo-enabled networks, the underlying transport layer resolves the embedded IPv4 destination and forwards the request there. An attacker registers a webhook whose hostname resolves to an address such as 64:ff9b::a9fe:a9fe (embedding 169.254.169.254), and the outbound HTTP client reaches the cloud metadata service. Vulnerability data pushed through the webhook is exfiltrated to the internal target [CWE-918].

Root Cause

The root cause is reliance on is_global as the sole SSRF filter without inspecting embedded IPv4 targets carried inside IPv6 transition addresses. The validator does not decompose IPv6 addresses into their ipv4_mapped, sixtofour, teredo, or NAT64 components before evaluating whether the effective destination is private, loopback, link-local, or otherwise restricted.

Attack Vector

Exploitation requires network access to the webhook registration interface. An attacker controls DNS for a hostname and returns an AAAA record pointing to an IPv6 transition address that embeds an internal IPv4 target. When the platform delivers vulnerability data to the webhook, the request is routed to the internal endpoint. This enables reconnaissance of internal services and data exfiltration to attacker-selected destinations reachable via the host's transition stack.

python

# Security patch from website/notifications/webhooks.py
# fix: [webhooks] block IPv6 transition addresses in SSRF guard (GHSA-mvm9-4fhw-xq)

# IPv6 transition addresses are globally routable per IANA (so ``is_global`` is
# True) yet carry an embedded IPv4 that the underlying transport reaches on a
# NAT64/6to4/Teredo-enabled network. Extracting that IPv4 lets us reject targets
# whose embedded destination is private, loopback, link-local, etc.
_NAT64_PREFIX = ipaddress.ip_network("64:ff9b::/96")


def _embedded_ipv4(ip: "ipaddress.IPv4Address | ipaddress.IPv6Address") -> list[ipaddress.IPv4Address]:
    """Return the IPv4 address(es) an IPv6 transition address embeds."""
    if not isinstance(ip, ipaddress.IPv6Address):
        return []
    embedded: list[ipaddress.IPv4Address] = []
    if ip.ipv4_mapped is not None:
        embedded.append(ip.ipv4_mapped)
    if ip.sixtofour is not None:
        embedded.append(ip.sixtofour)
    if ip.teredo is not None:
        # (server, client) — the client is the actual endpoint, but reject on
        # either being non-global.
        embedded.extend(ip.teredo)
    if ip in _NAT64_PREFIX:
        embedded.append(ipaddress.IPv4Address(int(ip) & 0xFFFFFFFF))
    return embedded

Source: GitHub Commit f3e0c68

Detection Methods for CVE-2026-72761

Indicators of Compromise

Outbound HTTP requests from the application host to IPv6 transition prefixes 64:ff9b::/96, 2002::/16, or 2001:0000::/32.
Webhook registrations resolving to hostnames with AAAA records inside transition address ranges.
Unexpected connections from the Vulnerability Lookup process to 169.254.169.254, 127.0.0.1, or RFC1918 destinations.

Detection Strategies

Inspect webhook configuration records for URLs whose DNS resolution produces IPv6 transition addresses embedding non-global IPv4 targets.
Correlate outbound network telemetry with webhook delivery events to identify traffic reaching internal endpoints.
Review application logs for HTTP client errors that indicate transition-address routing to internal services.

Monitoring Recommendations

Alert on any egress from the Vulnerability Lookup host to link-local, loopback, or metadata service addresses.
Baseline expected webhook destinations and flag deviations to IPv6 ranges not previously observed.
Enable DNS query logging on the application host to capture AAAA responses containing transition prefixes.

How to Mitigate CVE-2026-72761

Immediate Actions Required

Update Vulnerability Lookup to a build that includes commit f3e0c68 or later.
Audit existing webhook registrations and remove any whose hostnames resolve to IPv6 transition addresses.
Restrict webhook registration to trusted operators until the patched version is deployed.

Patch Information

The fix has been merged to HEAD in the Vulnerability Lookup repository. The patch introduces an _embedded_ipv4 helper that extracts embedded IPv4 addresses from IPv4-mapped, 6to4, Teredo, and NAT64 IPv6 addresses, then rejects the target when any embedded address fails the private/loopback/link-local checks. Review the GitHub commit f3e0c68 for the complete change.

Workarounds

Disable IPv6 on the application host or block outbound traffic to 64:ff9b::/96, 2002::/16, and 2001:0000::/32 at the network egress layer.
Route webhook deliveries through an egress proxy that enforces destination allowlists on the effective IPv4 endpoint.
Deny outbound access from the application host to cloud metadata IPs and internal management subnets.

bash

# Example nftables rules to block IPv6 transition prefixes from the app host
nft add rule inet filter output ip6 daddr 64:ff9b::/96 drop
nft add rule inet filter output ip6 daddr 2002::/16 drop
nft add rule inet filter output ip6 daddr 2001::/32 drop
# Block cloud metadata service over IPv4
nft add rule inet filter output ip daddr 169.254.169.254 drop