CVE-2026-122140 in Trawl
الملخص
بحسب MITRE • 04/11/2026
Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud metadata services and read responses.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.