Vulnerability record/PUBLISHED/Published Oct 22, 2026 02:09:40 UTC

CVE-2026-114730

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.

Base score7.2/ 10

SeverityHighCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityHigh

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredNonePR

User interactionNoneUI

ScopeChangedS

Confidentiality impactLowC

Integrity impactLowI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering Authoritymitre

Last updatedOct 28, 2026 02:18:48 UTC

PublishedOct 22, 2026 02:09:40 UTC

ReservedOct 22, 2026 02:09:39 UTC