Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-68507— ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass

Quick assessment

Affected
3xpyth0n ideon
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ideon 是一个自托管的可视化工作空间。在 0.9.5 版本之前，Ideon 的链接预览（link-preview）端点完全无需任何身份验证，且会将调用者提供的任意 URL 直接转发至服务器端进行抓取。虽然该应用具备通用的 SSRF 防护机制（位于 中的 / 函数），但该路由未设置任何登录检查，因此实际上成为一个完全开放、允许匿名访问的 URL 抓取中继服务。此外，该防护机制的 IP 黑名单本身存在漏洞：攻击者可通过 （代表“任意地址”）绕过限制，从而访问服务器自身的回环接口。这是一种在 Linux 系统上广为人

CVSS 6.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68507

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ideon: Unauthenticated /api/links/preview endpoint is an open SSRF relay, and its IP blocklist misses the 0.0.0.0/:: unspecified-address bypass
Source: CVE Program / CVE List V5
Vulnerability Description
ideon is a self-hosted visual workspace. Prior to version 0.9.5, ideon's link-preview endpoint requires no authentication at all and forwards any URL a caller supplies straight into a server-side fetch. The app does have a general-purpose SSRF guard (safeFetch/validateSafeUrl in src/app/lib/ssrf.ts), but this route sits behind no login check whatsoever, making it a fully open, anonymous URL-fetch relay - and the guard's IP blocklist itself has a gap that lets it reach the server's own loopback interface via the 0.0.0.0 "any address" bypass, a well-documented SSRF-filter evasion technique on Linux. This issue has been patched in version 0.9.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
3xpyth0n ideon < 0.9.5 -

II. Public POCs for CVE-2026-68507

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68507

请登录查看更多情报信息。

Other References for CVE-2026-68507 (2)

Same Patch Batch · 3xpyth0n · 2026-11-11 · 4 CVEs total

CVE-2026-65965 8.7 HIGH ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/fi
CVE-2026-103980 7.1 HIGH ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) i
CVE-2026-65968 5.3 MEDIUM ideon: Unauthenticated SSRF in /api/proxy/image via WHATWG bracketed/hex-mapped IPv6 bypas

IV. Related Vulnerabilities

Same product: ideon
Same vendor: 3xpyth0n
Same weakness: CWE-306