CVE-2026-84697

MediumCVSS 5.3/10Last modified Sep 10, 2026

Description

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Sep 2, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-846986.5PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplie CVE-2026-846999.1Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticat CVE-2026-84709.1IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic r CVE-2026-847008.6PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the CVE-2026-847015.4NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with CVE-2026-847027.5facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directo CVE-2026-847067.6A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates CVE-2026-847125.3A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ CVE-2026-847136.5A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ CVE-2026-847147.1A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular CVE-2026-847158.8FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated su CVE-2026-847166.6A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads