Medium severity6.5NVD Advisory· Published Oct 1, 2026· Updated Oct 1, 2026

CVE-2026-100251

Description

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Wormhole.app/wormhole.appllm-fuzzy
Range: <2026-08-22

Patches

Vulnerability mechanics

References

raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-04.jsonnvd
wormhole.appnvd
www.cve.org/CVERecordnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000