CVE-2026-84697— Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
Quick assessment
Affected
axllent mailpit
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mailpit 的 黑名单功能未能阻止 Azure WireServer 地址 以及符合 RFC 2765/6145 的 IPv4 转换的 IPv6 前缀，从而允许攻击者向内部目标发起服务器端请求伪造（SSRF）。攻击者可以在邮件内容中提供解析到这些地址的主机名，以访问链接检查 API 和代理端点，进而访问内部资源。
Possible ATT&CK Techniques 1 AI
T1012 · Query Registry
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84697
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Mailpit SSRF Deny List Bypass via Azure Metadata and IPv6 Prefix
Source: CVE Program / CVE List V5
Vulnerability Description
Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix, allowing server-side request forgery to internal destinations. Attackers can supply hostnames resolving to these addresses in message content to reach the link check API and proxy endpoint for accessing internal resources.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-84697
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84697
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-84697 (2)
-
🔗 mailpit/internal/tools/net.go at v1.31.0 · axllent/mailpit · GitHub Read full article technical-description
-
Vendor Advisories for CVE-2026-84697 (1)
IV. Related Vulnerabilities
Same product: mailpit
-
CVE-2026-67448
Mailpit: WebSocket origin check bypass via percent-encoded p -
CVE-2026-67447
Mailpit: SMTP DATA line reader buffers over-limit input befo -
CVE-2026-67445
Mailpit: SMTP command parser buffers unbounded command lines -
CVE-2026-67446
Mailpit: Thumbnail generation decodes unbounded image dimens -
CVE-2026-48824
Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounde
Same vendor: axllent
-
CVE-2026-67448
Mailpit: WebSocket origin check bypass via percent-encoded p -
CVE-2026-67447
Mailpit: SMTP DATA line reader buffers over-limit input befo -
CVE-2026-67445
Mailpit: SMTP command parser buffers unbounded command lines -
CVE-2026-67446
Mailpit: Thumbnail generation decodes unbounded image dimens -
CVE-2026-48824
Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounde
Same weakness: CWE-918
-
CVE-2026-76851
Server-Side Request Forgery vulnerability in GitHub Enterpri -
CVE-2026-18730
Server-side request forgery vulnerability in GitHub Enterpri -
CVE-2026-83548
SMA1000 工作区未认证SSRF漏洞 -
CVE-2026-8712
Wyoming < 1.10.2 SSRF via uri Query Parameter -
CVE-2026-84207
Heym before 0.0.98 SSRF via WebSocket endpoints
V. Comments for CVE-2026-84697
No comments yet