SSRF in junoclaw/wavs-bridge computeDataVerify (CVE-2026-43993)

SSRF in WAVS computeDataVerify allows cloud-metadata and internal-service access Vulnerability Overview The function in WAVS (which internally calls ) does not validate the protocol, port, or resolved IP when proxying endpoint URLs. The fix involves adding a dedicated SSRF protection module that enforces protocol and port whitelisting, pre-resolves DNS and blocks private IPs, local loopback, CGNAT, multicast, and reserved IPs (including IPv4-mapped IPv6), applies request timeouts via AbortController, and captures the response body for streaming. Known limitations include TOCTOU DNS rebinding (certain IPv6 special-purpose addresses), and it is recommended to implement egress firewalls at the deployment layer as defense-in-depth. Impact Software: Affected Versions: Fixed Version: CVSS v3 Score: 8.2 / 10 (High) CVSS Vector: CVE ID: CVE-2026-43993 Remediation Fixed Version: (commit ) Recommendation: Implement egress firewalls at the deployment layer as defense-in-depth. Disclosure Notes This announcement is intentionally concise. The full technical narrative (impact analysis, attack vectors, operational workarounds) is located in the under the tag and will be published in the post-mortem "When the Abbot Came." This is a deliberate disclosure hygiene choice: providing downstream defenders with a minimal GHSA-mirrored CVE number while preserving the narrative useful to attackers. It is not an incomplete announcement. Credits Audited by Flem Institute (April 2026). Recommendations and patches were written by Varagayvbedes in pair programming with Cascade (Windrush coding agent), under guidance.

Goal Reached Thanks to every supporter — we hit 100%!

SSRF in junoclaw/wavs-bridge computeDataVerify (CVE-2026-43993)

More from this source