{"id":"CVE-2026-103980","kind":"vulnerability","aliases":["CVE-2026-103980"],"related":[],"title":"ideon: SSRF filter misses IPv6 transition addresses, exposing internal networks","description":"ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6.","summary":"ideon is a self-hosted visual workspace whose SSRF check for link previews does not recognize IPv4-mapped, NAT64, 6to4 and Teredo IPv6 addresses that embed private IPv4 addresses. A logged-in user can use these addresses to make the server fetch cloud metadata endpoints, localhost services and internal networks.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ideon","other","self-hosted"],"not_affected_if":["no-user-accounts","version-0.9.6-or-later"],"how_to_check":"- Check the ideon version; `0.9.6` or later includes the fix, and anything earlier is affected per the sources.\n- Look for `isPrivateIP` in `src/app/lib/ssrf.ts` to confirm the current code.","fix":"- ideon: move to `0.9.6` or later.","status":"open","published_at":"2026-11-11T21:16:42+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","triaged_at":"2026-11-11T21:30:47+00:00","updated_at":"2026-11-11T21:30:47+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T21:30:47Z","model":"claude-haiku-5-5","output":{"fix":"- ideon: move to `0.9.6` or later.","reach":"internet","title":"ideon: SSRF filter misses IPv6 transition addresses, exposing internal networks","impact":"high","summary":"ideon is a self-hosted visual workspace whose SSRF check for link previews does not recognize IPv4-mapped, NAT64, 6to4 and Teredo IPv6 addresses that embed private IPv4 addresses. A logged-in user can use these addresses to make the server fetch cloud metadata endpoints, localhost services and internal networks.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ideon","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user reads cloud metadata credentials and internal services","analyst_note":"","how_to_check":"- Check the ideon version; `0.9.6` or later includes the fix, and anything earlier is affected per the sources.\n- Look for `isPrivateIP` in `src/app/lib/ssrf.ts` to confirm the current code.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.9.6-or-later","no-user-accounts"],"who_is_affected":"Self-hosted ideon instances running a version before 0.9.6 where users can create links that trigger the link preview metadata fetcher. Instances where only trusted users have accounts, or where outbound access from the server is tightly restricted, have less exposure. Hosted or managed deployments depend on the operator's patching.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000775,"input_tokens":4810,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103980':13A,16A '-2026':12A,15A '/16':153C '/32':159C '/48':148C '/96':138C '0.9.6':86C,199C '1':117C,147C '169.254.169.254':178C '1918':183C '2001':158C '2002':152C '3056':155C '4380':161C '6052':140C '64':136C,145C '6to4':43B,151C '8215':150C 'address':7A,47B,52B,61B,97C,102C,169C 'authent':164C 'bypass':93C 'check':32B,108C 'cloud':67B,175C 'cve':11A,14A 'emb':49B,99C 'encod':162C 'endpoint':69B,177C 'expos':8A 'fc/fd':119C 'fe80':123C 'fetch':66B 'fetcher':191C 'ff9b':137C,146C 'ffff':131C 'filter':3A 'function':105C 'host':21B,27B,80C 'ideon':1A,17B,22B,75C 'intern':9A,73B,184C 'ipv4':40B,51B,101C,129C 'ipv4-mapped':39B,128C 'ipv6':5A,46B,95C,114C 'isprivateip':104C 'issu':193C 'known':135C 'link':34B,121C,171C,188C 'link-loc':120C 'local':122C,143C 'local-us':142C 'localhost':70B,179C 'log':55B 'logged-in':54B 'loopback':116C 'make':63B 'map':41B,130C 'metadata':68B,176C,190C 'miss':4A 'narrow':111C 'nat64':42B,132C,141C 'network':10A,74B,185C 'patch':196C 'preview':35B,189C 'prior':83C 'privat':50B,100C 'protect':89C 'rang':115C 'reach':174C 'recogn':38B,127C 'rfc':139C,149C,154C,160C,182C 'safefetch':91C 'self':20B,26B,79C 'self-host':19B,25B,78C 'server':65B 'servic':71B,180C 'set':112C 'src/app/lib/ssrf.ts':107C 'ssrf':2A,31B,88C 'suppli':167C 'teredo':45B,157C 'transit':6A,96C 'ula':118C 'url':172C 'use':59B,144C 'user':57B,165C 'version':85C,198C 'visual':28B,81C 'well':134C 'well-known':133C 'whose':30B 'workspac':29B,82C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ideon instances running a version before 0.9.6 where users can create links that trigger the link preview metadata fetcher. Instances where only trusted users have accounts, or where outbound access from the server is tightly restricted, have less exposure. Hosted or managed deployments depend on the operator's patching.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ideon","other","selfhosted"],"campaign_type":null,"search_a":"'-103980':13A,16A '-2026':12A,15A 'address':7A 'cve':11A,14A 'expos':8A 'filter':3A 'ideon':1A 'intern':9A 'ipv6':5A 'miss':4A 'network':10A 'ssrf':2A 'transit':6A","search_b":"'6to4':43B 'address':47B,52B,61B 'check':32B 'cloud':67B 'emb':49B 'endpoint':69B 'fetch':66B 'host':21B,27B 'ideon':17B,22B 'intern':73B 'ipv4':40B,51B 'ipv4-mapped':39B 'ipv6':46B 'link':34B 'localhost':70B 'log':55B 'logged-in':54B 'make':63B 'map':41B 'metadata':68B 'nat64':42B 'network':74B 'preview':35B 'privat':50B 'recogn':38B 'self':20B,26B 'self-host':19B,25B 'server':65B 'servic':71B 'ssrf':31B 'teredo':45B 'use':59B 'user':57B 'visual':28B 'whose':30B 'workspac':29B","search_c":"'/16':153C '/32':159C '/48':148C '/96':138C '0.9.6':86C,199C '1':117C,147C '169.254.169.254':178C '1918':183C '2001':158C '2002':152C '3056':155C '4380':161C '6052':140C '64':136C,145C '6to4':151C '8215':150C 'address':97C,102C,169C 'authent':164C 'bypass':93C 'check':108C 'cloud':175C 'emb':99C 'encod':162C 'endpoint':177C 'fc/fd':119C 'fe80':123C 'fetcher':191C 'ff9b':137C,146C 'ffff':131C 'function':105C 'host':80C 'ideon':75C 'intern':184C 'ipv4':101C,129C 'ipv4-mapped':128C 'ipv6':95C,114C 'isprivateip':104C 'issu':193C 'known':135C 'link':121C,171C,188C 'link-loc':120C 'local':122C,143C 'local-us':142C 'localhost':179C 'loopback':116C 'map':130C 'metadata':176C,190C 'narrow':111C 'nat64':132C,141C 'network':185C 'patch':196C 'preview':189C 'prior':83C 'privat':100C 'protect':89C 'rang':115C 'reach':174C 'recogn':127C 'rfc':139C,149C,154C,160C,182C 'safefetch':91C 'self':79C 'self-host':78C 'servic':180C 'set':112C 'src/app/lib/ssrf.ts':107C 'ssrf':88C 'suppli':167C 'teredo':157C 'transit':96C 'ula':118C 'url':172C 'use':144C 'user':165C 'version':85C,198C 'visual':81C 'well':134C 'well-known':133C 'workspac':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-26T18:37:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103980","severity":null,"published_at":"2026-11-11T21:16:42+00:00","modified_at":"2026-11-11T21:16:42+00:00","first_seen_at":"2026-11-11T21:29:07+00:00","fetched_at":"2026-11-11T21:29:07+00:00","note":null}],"documents":[{"id":128953,"url":"https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":128954,"url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":128955,"url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-26T18:37:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}