CVE-2026-73058— stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-73058
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass
Source: CVE Program / CVE List V5
Vulnerability Description
stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-73058
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73058
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-73058 (2)
Same Patch Batch · stoatchat · 2026-08-16 · 3 CVEs total
| CVE-2026-73057 | 7.5 HIGH | stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Service |
| CVE-2026-73059 | 6.5 MEDIUM | stoatchat before 0.15.0 Permission Bypass via message_fetch |
IV. Related Vulnerabilities
Same product: stoatchat
- CVE-2026-73059
stoatchat before 0.15.0 Permission Bypass via message_fetch - CVE-2026-73057
stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Ser - CVE-2026-63088
stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass - CVE-2024-58360
stoatchat before 0.7.8 Unrestricted Account Creation - CVE-2026-63306
stoatchat before 0.13.5 Unauthenticated SSRF via proxy and e
Same vendor: stoatchat
- CVE-2026-73059
stoatchat before 0.15.0 Permission Bypass via message_fetch - CVE-2026-73057
stoatchat before 0.15.0 Uncapped SVG Rendering Denial of Ser - CVE-2026-57848
Stoat for Android Internal File Disclosure via Exported Shar - CVE-2026-63088
stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass - CVE-2024-58360
stoatchat before 0.7.8 Unrestricted Account Creation
Same weakness: CWE-918
- CVE-2026-19957
graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fet - CVE-2026-19956
gomarble-ai facebook-ads-mcp-server server.py fetch_paginati - CVE-2026-17123
Royal Addons for Elementor <= 1.7.1064 - Authenticated (Cont - CVE-2026-19927
OpenBoxes Product Upload Endpoint ProductController.groovy u - CVE-2026-74247
Quay: ssrf via build archive_url in quay build api
V. Comments for CVE-2026-73058
No comments yet