Medium severity5.0NVD Advisory· Published Sep 8, 2026

CVE-2026-86735

Description

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards and access internal services or cloud metadata endpoints.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grokability/Snipe Itllm-fuzzy
Range: <8.7.0

Patches

Vulnerability mechanics

References

github.com/grokability/snipe-it/security/advisories/GHSA-5j6m-rr83-rpj7nvd
www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-via-ipv6-transition-address-bypassnvd

News mentions

No linked articles in our index yet.

cvss	0.325
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000