CVE-2026-72761 in Vulnerability Lookup
Riassunto
di MITRE • 10/08/2026
The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, so `is_global` returns `True` even when the embedded IPv4 targets a private, loopback, or cloud metadata destination. An attacker can register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint.
The vulnerability was introduced on a non-release version. The fix was already done on HEAD. It only affects
organisation running the HEAD.
If you want to get best quality of vulnerability data, you may have to visit VulDB.