CVE-2026-122140

    Dashboard / Vulnerabilities / CVE-2026-122140

    CVE-2026-122140

    Published: 4 Nov 2026Last Modified: 5 Nov 2026

    Summary: Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass

    Details: Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 directly or via redirects to fetch loopback, private, and cloud metadata services and read responses.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122140.json, https://github.com/germondai/trawl/releases/tag/v1.10.0, https://github.com/germondai/trawl/security/advisories/GHSA-mj45-84p2-v77q, https://nvd.nist.gov/vuln/detail/CVE-2026-122140, https://www.vulncheck.com/advisories/trawl-1.5.0-before-1.10.0-ssrf-via-ipv4-mapped-ipv6-mcp-policy-bypass, https://github.com/germondai/trawl/commit/17cdb33a9a6a8200cf8f9fd6a57b295b04ee5173, https://github.com/germondai/trawl/pull/263, https://github.com/germondai/trawl, https://github.com/germondai/trawl/blob/v1.9.3/apps/api/src/outbound-policy.ts#L55-L56

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- c81d628b4d509ceb6e4ae4567f0ffb62d4eeb051
    Fixed -fc3f64a7eebc9776c39bad1b5ed72b461cd3cdbb

    Affected versions

    v1.9.3
    v1.9.2
    v1.9.1
    v1.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-122140 | CVE-DB