CVE-2026-103980 · Other
NO FIX YET · SEE WHAT TO DO
ideon is a self-hosted visual workspace whose SSRF check for link previews does not recognize IPv4-mapped, NAT64, 6to4 and Teredo IPv6 addresses that embed private IPv4 addresses. A logged-in user can use these addresses to make the server fetch cloud metadata endpoints, localhost services and internal networks.
first public Jul 26, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted ideon instances running a version before 0.9.6 where users can create links that trigger the link preview metadata fetcher. Instances where only trusted users have accounts, or where outbound access from the server is tightly restricted, have less exposure. Hosted or managed deployments depend on the operator's patching.
Not affected if no-user-accounts, version-0.9.6-or-later
Who cares ideon, self-hosted
0.9.6 or later includes the fix, and anything earlier is affected per the sources.isPrivateIP in src/app/lib/ssrf.ts to confirm the current code.0.9.6 or later.ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.