What is CVE-2026-72761?
CVE-2026-72796 is an SSRF vulnerability in the webhook URL validator of `website/notifications/webhooks.py` caused by the `is_global` check incorrectly classifying IPv6 transition addresses (NAT64, 6to4, Teredo) as globally routable. This could allow attackers to bypass restrictions and send requests to internal networks. Additional checks to reject these transition address ranges should be implemented.
Azərbaycanca: CVE-2026-72796, `website/notifications/webhooks.py` faylındakı webhook URL doğrulayıcısının IPv6 keçid ünvanlarını (NAT64, 6to4, Teredo) `is_global` ilə səhvən qlobal olaraq tanıması nəticəsində yaranan SSRF zəifliyidir. Bu, təcavüzkarlara daxili şəbəkələrə yönləndirilmiş sorğular göndərməyə imkan verə bilər. Keçid ünvanlarını bloklayan əlavə yoxlamalar tətbiq edilməlidir.
Related CVEs
link basis: same weakness class CWE-918
FAQ2
What is the root cause of CVE-2026-72796?
The vulnerability stems from the `is_global` check in the webhook URL validator of `website/notifications/webhooks.py` incorrectly classifying IPv6 transition addresses (NAT64, 6to4, Teredo) as globally routable.
What type of attack can be performed if CVE-2026-72796 is exploited?
Through this SSRF vulnerability, an attacker can bypass restrictions and send requests directed to internal networks.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.