MEDIUM
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
Published Sep 2, 2026
6.9
MEDIUMCVSS 4.0
EPSS 0.40%
Description
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.
Affected products
-
- Version 0StatusaffectedConstraints<=1.31.0
- Version
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- https://github.com/axllent/mailpit product
- https://github.com/axllent/mailpit/blob/v1.31.0/internal/tools/net.go technical-description
- https://github.com/axllent/mailpit/commit/a02821bf3424da9196e156c422370f4868a1dff2 patch
- https://www.vulncheck.com/advisories/mailpit-ssrf-deny-list-bypass-via-azure-metadata-and-ipv6-prefix third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/axllent/mailpit | product | |
| https://github.com/axllent/mailpit/blob/v1.31.0/internal/tools/net.go | technical-description | |
| https://github.com/axllent/mailpit/commit/a02821bf3424da9196e156c422370f4868a1dff2 | patch | |
| https://www.vulncheck.com/advisories/mailpit-ssrf-deny-list-bypass-via-azure-metadata-and-ipv6-prefix | third-party-advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Sep 2, 2026
Updated Sep 2, 2026
Reserved Sep 1, 2026
Link CVE-2026-84697
CISA Vulnrichment
Updated Sep 2, 2026