CVE-2026-8712: Wyoming SSRF Vulnerability

CVE-2026-8712 Overview

CVE-2026-8712 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Wyoming voice satellite protocol server before version 1.10.2. The flaw allows unauthenticated attackers with network access to force the server to open outbound connections to arbitrary hosts. Attackers supply a malicious uri query parameter to HTTP API endpoints such as /api/info, /api/speech-to-text, and /api/text-to-speech. The server accepts tcp:// and unix:// URIs, overriding the configured backend and redirecting connections to attacker-chosen destinations.

Critical Impact
Unauthenticated remote attackers can pivot Wyoming servers to reach internal network services or local Unix domain sockets, enabling reconnaissance and limited interaction with otherwise unreachable systems.

Affected Products

Wyoming voice satellite server versions prior to 1.10.2
Deployments exposing the Wyoming HTTP API on network-reachable interfaces
Home Assistant integrations that embed the Wyoming protocol server

Discovery Timeline

2026-09-01 - CVE-2026-8712 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-8712

Vulnerability Analysis

Wyoming is an open-source voice protocol server that exposes an HTTP API for speech-to-text, text-to-speech, and service metadata operations. The API accepts a uri query parameter intended to reference the backend service the server should communicate with. The server passes this value into its outbound connection logic without validating that the destination matches a configured or trusted backend.

Because the parameter accepts arbitrary tcp://host:port and unix://path schemes, an attacker can instruct the server to connect to any reachable TCP endpoint or local Unix domain socket. This grants attackers a network pivot point through the Wyoming host, bypassing perimeter controls that would otherwise block direct access to internal services.

Root Cause

The root cause is missing allowlist validation on user-supplied URIs [CWE-918]. The affected HTTP handlers deserialize the uri query parameter and hand it directly to the connection layer. No comparison is made against the operator-configured backend, and no scheme, host, or path restrictions are enforced before the outbound socket is opened.

Attack Vector

An unauthenticated attacker sends an HTTP request to a vulnerable endpoint with a crafted uri parameter. Requests to /api/info, /api/speech-to-text, or /api/text-to-speech carrying uri=tcp://internal-host:port cause the server to initiate a TCP connection to the specified target. Supplying uri=unix:///path/to/socket forces the server to interact with local Unix domain sockets, which can include privileged system services. The attack requires only network reachability to the Wyoming HTTP port and no user interaction.

See the Vulncheck SSRF Advisory for endpoint-specific request examples.

Detection Methods for CVE-2026-8712

Indicators of Compromise

HTTP requests to /api/info, /api/speech-to-text, or /api/text-to-speech containing a uri query parameter with tcp:// or unix:// schemes pointing to non-configured hosts.
Outbound TCP connections from the Wyoming process to internal RFC1918 addresses or loopback ports that do not match the operator-configured backend.
Unexpected Wyoming server access to local Unix domain sockets outside its normal working set.

Detection Strategies

Inspect web-server or reverse-proxy access logs for uri= parameters on Wyoming API endpoints and alert on values that do not match the approved backend URI.
Correlate inbound HTTP requests on the Wyoming port with subsequent outbound socket activity from the same process to detect SSRF-driven pivots.
Baseline the Wyoming service's normal network destinations and flag deviations, particularly connections to management ports (SSH, database, metadata services).

Monitoring Recommendations

Enable process-level network telemetry on hosts running Wyoming to capture destination IP, port, and scheme for every outbound connection.
Forward Wyoming HTTP access logs to a centralized logging platform and build detection rules that key on the uri query parameter.
Monitor for repeated failed connections from the Wyoming process, which often indicate SSRF scanning behavior.

How to Mitigate CVE-2026-8712

Immediate Actions Required

Upgrade Wyoming to version 1.10.2 or later, which restricts the accepted uri values.
Restrict network access to the Wyoming HTTP API using host firewalls or network ACLs so it is reachable only from trusted management hosts.
Audit recent HTTP logs for suspicious uri query parameters and investigate any matches for signs of reconnaissance or lateral movement.

Patch Information

The maintainers fixed the issue in Wyoming 1.10.2. The release notes and source diff are available at the GitHub Release v1.10.2. The patch validates the uri parameter against the server-configured backend and rejects arbitrary tcp:// and unix:// destinations.

Workarounds

Place the Wyoming HTTP API behind a reverse proxy that strips or validates the uri query parameter before forwarding requests.
Bind the Wyoming service to 127.0.0.1 or an isolated management interface until patching is complete.
Run the Wyoming process in a network namespace or container with egress restricted to the intended backend host and port.

bash

# Example iptables egress restriction for the Wyoming process user (uid 1500)
iptables -A OUTPUT -m owner --uid-owner 1500 -p tcp -d <backend-ip> --dport <backend-port> -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner 1500 -j REJECT