Live › vulnerability › CVE-2026-114730
Go to dashboardRoundcube's check for local URLs misses the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48 and the unspecified address ::/128, so IPv6 URLs like http://[64:ff9b::7f00:1]/ pass. The server can then be made to request loopback, link-local and cloud metadata addresses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Roundcube Webmail installations on the affected version ranges are exposed, because the flaw sits in the URL filter that the server uses before fetching remote content. Systems running on cloud hosts with instance metadata endpoints deserve the most attention, since those are the targets the bypass reaches. Installations already on , or later can skip it.
1.6.201.7.5No product ranges from the sources yet.
1.6.14 to 1.6.19, or 1.7.0 to 1.7.4.1.6.20 or later.1.7.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
This page as .md · .json · in your agent: get_signal("CVE-2026-114730")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.