CVE-2026-85738 liketrek CVE debrief

Who should care

Defenders responsible for TREK deployments, especially those routing IPv6 transition addresses, should assess exposure and apply the patch. Security teams should verify if internal services or cloud metadata could be exposed and prioritize remediation accordingly.

Why it matters

CVE-2026-85738 is a Server-Side Request Forgery (SSRF) vulnerability in TREK collaborative travel planner prior to version 3.4.0. The vulnerability allows authenticated users to bypass SSRF protections and potentially access internal services or cloud metadata by supplying URLs with specific IPv6 transition addresses. Defenders should prioritize verifying exposure, applying the patch, and updating SSRF protections to account for IPv6 transition addresses. Evidence is limited regarding actual exploitation or specific affected deployments, but the vendor has released a patch in version 3.4.0.

• Potential information exposure in TREK deployments that route specific IPv6 transition formats.
• Authenticated users could bypass SSRF protections to access internal services.
• Cloud metadata could be exposed in affected deployments.
• Verification of exposure and patch application is necessary to prevent potential abuse.

Technical summary

The checkSsrf logic in TREK server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses. An authenticated user can supply a URL with an AAAA result that is a transition address embedding a private, loopback, or link-local IPv4 target, potentially allowing access to internal services or cloud metadata. This vulnerability allows for potential information exposure in deployments that route specific IPv6 transition formats. Defenders should prioritize verifying exposure and applying the patch.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for potential information exposure in deployments that route specific IPv6 transition formats.

Recommended defensive actions

• Verify if the TREK collaborative travel planner is deployed in an environment that routes IPv6 transition addresses.
• Check if the current version is prior to 3.4.0 and apply the patch if necessary.
• Review and update SSRF protections to account for IPv6 transition addresses.
• Monitor for potential abuse of the vulnerability in the environment.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but evidence is limited regarding actual exploitation or specific affected deployments. The vendor has released a patch in version 3.4.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.