CVE-2026-82476— Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Quick assessment
Affected
usememos memos
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Memos 0.30.0 及之前版本在链接元数据抓取器中的 SSRF 防护中遗漏了 100.64.0.0/10 运营商级 NAT 地址段，导致未认证的攻击者可以绕过 IP 校验。攻击者可以让服务器请求该地址段内的内部主机（包括云元数据服务），并读取返回的页面标题和描述。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82476
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Source: CVE Program / CVE List V5
Vulnerability Description
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-82476
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82476
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82476 (1)
Vendor Advisories for CVE-2026-82476 (1)
-
🔗 Memos through 0.30.0 SSRF via Omitted CGNAT Address Range | Advisories | VulnCheck third-party-advisory
Proof of Concept for CVE-2026-82476 (1)
Other References for CVE-2026-82476 (1)
IV. Related Vulnerabilities
Same product: memos
-
CVE-2026-75110
MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRE -
CVE-2026-71271
Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass -
CVE-2026-71272
Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() -
CVE-2026-6634
usememos UpdateInstanceSetting App.tsx memos_access_token im -
CVE-2024-21635
Memos Access Tokens Stay Valid after User Password Change
Same vendor: usememos
-
CVE-2026-71271
Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass -
CVE-2026-71272
Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext() -
CVE-2026-6634
usememos UpdateInstanceSetting App.tsx memos_access_token im -
CVE-2024-21635
Memos Access Tokens Stay Valid after User Password Change -
CVE-2023-0109
Stored XSS in usememos/memos
Same weakness: CWE-918
-
CVE-2026-82477
MITRE SAF Heimdall 2.11.6至2.13.x SSRF漏洞 -
CVE-2026-18545
Langflow is affected by multiple authentication bypass, path -
CVE-2026-55245
Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT -
CVE-2026-82289
Gitingest Prefix-Based Git Host Check Enables Request Forger -
CVE-2026-82285
BISHENG Unauthenticated Server-Side Request Forgery via Work
V. Comments for CVE-2026-82476
No comments yet