Roundcube

CVE-2026-114730: Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_ut

CVE-2026-114730 Oct 22, 2026 Source: Vendor

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_u

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-114730

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

9 lines

Showing 1–9 of 9

CVE-2026-114730 BR2026-0000-030556 unclaimed

Credited as Wahab “NeoX” K

CVE-2026-114730 BR2026-0000-030557 unclaimed

Credited as Milan Hoppe

CVE-2026-114730 BR2026-0000-030558 unclaimed

Credited as dizconnect

CVE-2026-114730 BR2026-0000-030559 unclaimed

Credited as Paulos Yibelo

CVE-2026-114730 BR2026-0000-030560 unclaimed

Credited as Clay

CVE-2026-114730 BR2026-0000-030561 unclaimed

Credited as Sunil Tripathy

CVE-2026-114730 BR2026-0000-030562 unclaimed

Credited as Oli Z

CVE-2026-114730 BR2026-0000-030563 unclaimed

Credited as GoldenSW

CVE-2026-114730 BR2026-0000-030564 unclaimed

Credited as Squirt1e, Atum, N0b0dy, and Gh0u1L5