{"id":"CVE-2026-65968","kind":"vulnerability","aliases":["CVE-2026-65968"],"related":[],"title":"ideon: SSRF guard misses IPv4-mapped IPv6 hosts, enabling internal fetches","description":"ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new URL(url).hostname. Their IPv6 branch only recognises the textual forms ::1, fe80:/fc00:/fd00: prefixes, and the dotted-decimal IPv4-mapped form ::ffff:127.x. It does not recognise the WHATWG-canonical IPv4-mapped-IPv6 host that Node emits for a mapped address, which is hex-compressed and bracket-wrapped: [::ffff:7f00:1] for 127.0.0.1, [::ffff:a9fe:a9fe] for 169.254.169.254. An authenticated user who registers a STREAMABLE_HTTP / SSE MCP server with URL http://[::ffff:7f00:1]:PORT/ (loopback) or http://[::ffff:a9fe:a9fe]/ (cloud metadata) passes both guards, and the server-side OAuth-discovery action then fetches that host, yielding server-side request forgery to loopback and to the cloud metadata service. This issue has been patched in version 0.9.4.","summary":"ideon, a self-hosted visual workspace, blocks server-side requests to private addresses by matching host strings, and misses the hex-compressed IPv4-mapped IPv6 form Node produces. An authenticated user who registers an MCP server at such an address can make the server fetch loopback services and the cloud metadata endpoint.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","ideon","mcp","package","self-hosted"],"not_affected_if":["no-user-registered-mcp-urls","version-0.9.4-or-later"],"how_to_check":"- Check the installed ideon version; versions below `0.9.4` are affected.\n- Look for `validateUrlForSSRF` in `lib/oauth/ssrf-protection.ts` and `validateMcpUrl` in `lib/security/validators.ts`.","fix":"- ideon: upgrade to `0.9.4` or later.","status":"open","published_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","triaged_at":"2026-11-11T21:30:56+00:00","updated_at":"2026-11-11T21:30:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T21:30:56Z","model":"claude-haiku-5-5","output":{"fix":"- ideon: upgrade to `0.9.4` or later.","reach":"network","title":"ideon: SSRF guard misses IPv4-mapped IPv6 hosts, enabling internal fetches","impact":"medium","summary":"ideon, a self-hosted visual workspace, blocks server-side requests to private addresses by matching host strings, and misses the hex-compressed IPv4-mapped IPv6 form Node produces. An authenticated user who registers an MCP server at such an address can make the server fetch loopback services and the cloud metadata endpoint.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ideon","self-hosted","mcp","cloud"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"server fetches internal services and cloud metadata credentials","analyst_note":"","how_to_check":"- Check the installed ideon version; versions below `0.9.4` are affected.\n- Look for `validateUrlForSSRF` in `lib/oauth/ssrf-protection.ts` and `validateMcpUrl` in `lib/security/validators.ts`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.9.4-or-later","no-user-registered-mcp-urls"],"who_is_affected":"Teams that self-host ideon and let users register MCP servers or OAuth endpoints with URLs. Exposure depends on whether untrusted or lower-privilege users can add such URLs and whether the server can reach loopback or cloud metadata. Instances on version 0.9.4 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000789,"input_tokens":4926,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-65968':15A,18A '/fc00':127C '/fd00':128C '0.9.4':93C,242C '1':125C,173C,196C '127':140C '127.0.0.1':175C '169.254.169.254':180C '7f00':172C,195C 'a9fe':177C,178C,201C,202C 'action':216C 'address':40B,69B,161C 'authent':59B,182C 'block':33B,108C 'bracket':169C 'bracket-wrap':168C 'branch':119C 'canon':149C 'cloud':19B,79B,203C,232C 'compress':50B,166C 'cve':13A,16A 'decim':134C 'discoveri':215C 'dot':133C 'dotted-decim':132C 'emit':157C 'enabl':10A 'endpoint':81B 'fe80':126C 'fetch':12A,74B,218C 'ffff':139C,171C,176C,194C,200C 'forgeri':226C 'form':55B,124C,138C 'guard':3A,207C 'hex':49B,165C 'hex-compress':48B,164C 'host':9A,25B,30B,43B,87C,107C,154C,220C 'host-block':106C 'hostnam':116C 'http':188C 'ideon':1A,20B,26B,82C 'intern':11A 'ipv4':6A,52B,136C,151C 'ipv4-mapped':5A,51B,135C 'ipv4-mapped-ipv6':150C 'ipv6':8A,54B,118C,153C 'issu':236C 'lib/oauth/ssrf-protection.ts':97C 'lib/security/validators.ts':103C 'loopback':75B,198C,228C 'make':71B 'map':7A,53B,137C,152C,160C 'match':42B,111C 'mcp':21B,64B,190C 'metadata':80B,204C,233C 'miss':4A,46B 'new':113C 'node':56B,156C 'oauth':214C 'oauth-discoveri':213C 'packag':22B 'parallel':100C 'pass':205C 'patch':239C 'perform':104C 'port':197C 'prefix':129C 'prior':90C 'privat':39B 'produc':57B 'recognis':121C,145C 'regist':62B,185C 'request':37B,225C 'safefetch':95C 'self':24B,29B,86C 'self-host':23B,28B,85C 'server':35B,65B,73B,191C,211C,223C 'server-sid':34B,210C,222C 'servic':76B,234C 'side':36B,212C,224C 'sse':189C 'ssrf':2A,105C 'streamabl':187C 'string':44B 'string/regex':110C 'textual':123C 'url':114C,115C,193C 'user':60B,183C 'validatemcpurl':101C 'validateurlforssrf':94C 'version':92C,241C 'visual':31B,88C 'whatwg':148C 'whatwg-canon':147C 'workspac':32B,89C 'wrap':170C 'x':141C 'yield':221C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host ideon and let users register MCP servers or OAuth endpoints with URLs. Exposure depends on whether untrusted or lower-privilege users can add such URLs and whether the server can reach loopback or cloud metadata. Instances on version 0.9.4 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloud","ideon","mcp","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-65968':15A,18A 'cve':13A,16A 'enabl':10A 'fetch':12A 'guard':3A 'host':9A 'ideon':1A 'intern':11A 'ipv4':6A 'ipv4-mapped':5A 'ipv6':8A 'map':7A 'miss':4A 'ssrf':2A","search_b":"'address':40B,69B 'authent':59B 'block':33B 'cloud':19B,79B 'compress':50B 'endpoint':81B 'fetch':74B 'form':55B 'hex':49B 'hex-compress':48B 'host':25B,30B,43B 'ideon':20B,26B 'ipv4':52B 'ipv4-mapped':51B 'ipv6':54B 'loopback':75B 'make':71B 'map':53B 'match':42B 'mcp':21B,64B 'metadata':80B 'miss':46B 'node':56B 'packag':22B 'privat':39B 'produc':57B 'regist':62B 'request':37B 'self':24B,29B 'self-host':23B,28B 'server':35B,65B,73B 'server-sid':34B 'servic':76B 'side':36B 'string':44B 'user':60B 'visual':31B 'workspac':32B","search_c":"'/fc00':127C '/fd00':128C '0.9.4':93C,242C '1':125C,173C,196C '127':140C '127.0.0.1':175C '169.254.169.254':180C '7f00':172C,195C 'a9fe':177C,178C,201C,202C 'action':216C 'address':161C 'authent':182C 'block':108C 'bracket':169C 'bracket-wrap':168C 'branch':119C 'canon':149C 'cloud':203C,232C 'compress':166C 'decim':134C 'discoveri':215C 'dot':133C 'dotted-decim':132C 'emit':157C 'fe80':126C 'fetch':218C 'ffff':139C,171C,176C,194C,200C 'forgeri':226C 'form':124C,138C 'guard':207C 'hex':165C 'hex-compress':164C 'host':87C,107C,154C,220C 'host-block':106C 'hostnam':116C 'http':188C 'ideon':82C 'ipv4':136C,151C 'ipv4-mapped':135C 'ipv4-mapped-ipv6':150C 'ipv6':118C,153C 'issu':236C 'lib/oauth/ssrf-protection.ts':97C 'lib/security/validators.ts':103C 'loopback':198C,228C 'map':137C,152C,160C 'match':111C 'mcp':190C 'metadata':204C,233C 'new':113C 'node':156C 'oauth':214C 'oauth-discoveri':213C 'parallel':100C 'pass':205C 'patch':239C 'perform':104C 'port':197C 'prefix':129C 'prior':90C 'recognis':121C,145C 'regist':185C 'request':225C 'safefetch':95C 'self':86C 'self-host':85C 'server':191C,211C,223C 'server-sid':210C,222C 'servic':234C 'side':212C,224C 'sse':189C 'ssrf':105C 'streamabl':187C 'string/regex':110C 'textual':123C 'url':114C,115C,193C 'user':183C 'validatemcpurl':101C 'validateurlforssrf':94C 'version':92C,241C 'visual':88C 'whatwg':148C 'whatwg-canon':147C 'workspac':89C 'wrap':170C 'x':141C 'yield':221C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T20:39:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65968","severity":null,"published_at":"2026-11-11T21:16:46+00:00","modified_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","fetched_at":"2026-11-11T21:29:09+00:00","note":null}],"documents":[{"id":129012,"url":"https://github.com/3xpyth0n/ideon/commit/58e2f26bb7259d24c963a753962ac34f56c63b01","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129010,"url":"https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129014,"url":"https://github.com/3xpyth0n/ideon/security/advisories/GHSA-cvcr-fcf6-366r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T20:39:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}