CVE-2026-122140 in Trawl
Summary
by MITRE • 11/04/2026
Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud metadata services and read responses.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in Trawl versions prior to 1.10.0 represents a critical server-side request forgery flaw that stems from insufficient validation of network addresses during outbound HTTP requests. This security deficiency allows unauthenticated attackers to circumvent the configured MCP outbound URL policy, which is designed to restrict or monitor external connections initiated by the application. The core technical issue lies in how the underlying networking stack interprets IPv4-mapped IPv6 addresses. Specifically, when an attacker supplies a hex-normalized address such as ::ffff:7f00:1, the system fails to correctly resolve this format against its internal allow or deny lists. This misinterpretation occurs because many network libraries and operating systems treat IPv4-mapped IPv6 addresses as equivalent to their standard IPv4 counterparts for routing purposes, yet the application's security logic does not perform a normalization step before comparing the target address against policy rules. Consequently, an attacker can effectively mask private or loopback IP ranges within valid-looking IPv6 syntax, tricking the server into making requests to internal resources that should be blocked by the outbound URL policy.
The operational impact of this vulnerability is severe, as it enables remote code execution scenarios indirectly through data exfiltration and internal network reconnaissance. By exploiting this bypass, an attacker can force the vulnerable application to fetch content from loopback interfaces, private local networks, or cloud metadata services such as AWS EC2 instance metadata service (IMDS) or Azure managed identity endpoints. These internal services often contain sensitive configuration details, authentication tokens, and credentials that are not intended for external access. The ability to read responses from these services allows attackers to harvest secrets, escalate privileges within the local infrastructure, or pivot further into the network. Since the attack requires no authentication, it significantly lowers the barrier to entry for malicious actors, making this a high-risk vulnerability that can lead to complete compromise of the host environment and any connected internal systems.
From a classification perspective, this flaw aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically highlighting the sub-category related to bypassing URL filters through address format manipulation. It also maps to MITRE ATT&CK technique T1557.002 Adversary-in-the-Middle, as the attacker leverages the application itself to interact with internal services, effectively using the server as a proxy for malicious requests. To mitigate this vulnerability, organizations must upgrade immediately to version 1.10.0 or later where the issue has been addressed. In addition to upgrading, security teams should implement strict input validation that normalizes all IP addresses before policy evaluation. This includes explicitly rejecting IPv4-mapped IPv6 formats when only standard IPv4 or pure IPv6 is expected, and ensuring that loopback ranges (127.0.0.0/8 for IPv4 and ::1/128 for IPv6) are blocked regardless of their representation format. Furthermore, deploying a network-level firewall rule to block outbound connections from the application server to private IP ranges provides an additional layer of defense against SSRF attacks that might bypass application-layer controls.