CVE-2026-82757— ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Quick assessment
Affected
ash-project ash_authentication_oauth2_server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述信息的中文翻译： Ash 项目中 ash_authentication_oauth2_server 组件存在服务器端请求伪造（SSRF）漏洞。如果攻击者能够控制客户端元数据 URL 及其 DNS 解析，就可以诱导服务器连接到内部地址或回环地址。 函数位于 中，负责强制执行 CIMD 元数据获取的出站策略。该函数错误地将几种非公共可路由的地址形式分类为公共可路由地址，具体包括：IPv4 兼容地址段 （例如 ）、SIIT IPv4 转换地址段 ，以及已弃用的站点本地地址段 。当返回的 AAAA 记录落在
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82757
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF
Source: CVE Program / CVE List V5
Vulnerability Description
Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to internal or loopback addresses.
public_ip?/1 in AshAuthentication.Oauth2Server.CIMD.ReqFetcher enforces the outbound policy for CIMD metadata fetches. It classified several address forms as publicly routable that are not: IPv4-compatible ::/96 (for example ::127.0.0.1), SIIT IPv4-translated ::ffff:0:0:0/96, and deprecated site-local fec0::/10. A returned AAAA record in one of these ranges passed the policy, so a fetch pinned to that address reached space the policy was meant to block.
This issue affects ash_authentication_oauth2_server: from 0.3.0 before 0.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ash-project | ash_authentication_oauth2_server | 0.3.0 ~ 0.3.1 |
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*
|
|
| ash-project | ash_authentication_oauth2_server | e713a9ba816761140c226e2ca55b75c0b93f5984 ~ 268b591261a3473ab9b87272963e4dd2fd99d972 |
cpe:2.3:a:ash-project:ash_authentication_oauth2_server:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-82757
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82757
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-82757 (1)
Vendor Advisories for CVE-2026-82757 (2)
Vendor Pages for CVE-2026-82757 (1)
-
🔗 CVE-2026-82757 related
Same Patch Batch · ash-project · 2026-09-07 · 9 CVEs total
| CVE-2026-82753 | 8.2 HIGH | Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and c |
| CVE-2026-82586 | 8.2 HIGH | AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private at |
| CVE-2026-82755 | 6.3 MEDIUM | ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheab |
| CVE-2026-82758 | 6.3 MEDIUM | ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gat |
| CVE-2026-82754 | 6.3 MEDIUM | ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypas |
| CVE-2026-82756 | 6.3 MEDIUM | ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenti |
| CVE-2026-82584 | 2.3 LOW | Terminal escape sequence injection in the mix igniter.install confirmation prompt via pack |
| CVE-2026-81638 | 2.1 LOW | Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry |
IV. Related Vulnerabilities
Same product: ash_authentication_oauth2_server
-
CVE-2026-82758
ash_authentication_oauth2_server treats an empty resolved se -
CVE-2026-82756
ash_authentication_oauth2_server interpolates a tenant-deriv -
CVE-2026-82755
ash_authentication_oauth2_server serves tenant-specific OAut -
CVE-2026-82754
ash_authentication_oauth2_server aliases every protocol endp -
CVE-2026-82753
Unauthenticated authorize requests create unbounded, never-e
Same vendor: ash-project
-
CVE-2026-82710
Terminal escape sequence injection in mix usage_rules.search -
CVE-2026-82584
Terminal escape sequence injection in the mix igniter.instal -
CVE-2026-82586
AshLua read operation aggregate bypasses the exposed-field a -
CVE-2026-81638
Non-canonical ULID spellings are accepted and alias to the s -
CVE-2026-82758
ash_authentication_oauth2_server treats an empty resolved se
Same weakness: CWE-918
-
CVE-2026-86590
Eclipse Che 7.79.0-7.121.0 服务端请求伪造（SSRF） -
CVE-2026-81806
WordPress Hide My WP Ghost plugin <= 7.0.09 - Server Side Re -
CVE-2026-76971
Server-Side Request Forgery in SAP Manufacturing Integration -
CVE-2026-86539
knowns through 0.33.0 Server-Side Request Forgery via embedd -
CVE-2026-86503
IntelliJ IDEA <2026.2.2 打开项目触发SSRF
V. Comments for CVE-2026-82757
No comments yet