CVE-2026-72761 vulnerability-lookup CVE debrief

Who should care

Organizations running the affected system, particularly those with security and development teams responsible for webhook configurations and SSRF guard implementations, should prioritize validating webhook configurations and ensuring that IPv6 transition addresses are properly handled to prevent SSRF bypass. This includes reviewing and updating SSRF guard configurations to account for IPv6 transition addresses and performing inventory checks for affected systems.

Technical summary

The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. However, IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, allowing an attacker to register a webhook pointing at a hostname that resolves to a transition address to bypass the SSRF guard and exfiltrate vulnerability data to an internal endpoint. The affected product or component is the webhook URL validator in `website/notifications/webhooks.py`.

Defensive priority

Organizations should prioritize validating webhook configurations and ensuring that IPv6 transition addresses are properly handled to prevent SSRF bypass.

Recommended defensive actions

• Validate webhook configurations to ensure proper handling of IPv6 transition addresses
• Implement compensating controls to monitor and restrict internal endpoint access
• Review and update SSRF guard configurations to account for IPv6 transition addresses
• Perform inventory checks for affected systems and apply vendor remediation
• Monitor for suspicious activity and track exceptions

Evidence notes

The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally routable by IANA, allowing an attacker to bypass the SSRF guard. To verify, defenders should check the affected system's webhook configurations and ensure proper handling of IPv6 transition addresses. Additionally, they should review the system's security and development teams' awareness of this vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.