CVE-2026-86735: 
NixOS vulnerability analysis and mitigation

CVE-2026-86735 is a Server-Side Request Forgery (SSRF) vulnerability in Snipe-IT, an open-source IT asset management application developed by Grokability, Inc. The flaw exists in the ExternalUrl validation rule (app/Rules/ExternalUrl.php), which fails to detect IPv6 transition addresses (NAT64, 6to4, Teredo) that encode private IPv4 targets, allowing SSRF guards to be bypassed. All versions of snipe-it before 8.7.0 are affected; version 8.7.0 and later are patched. It carries a CVSS v3.1 base score of 5.0 (Medium) and a CVSS v4.0 base score of 5.9 (Medium) (GitHub Advisory).

The root cause (CWE-918: Server-Side Request Forgery) lies in the isPublicIp() method within app/Rules/ExternalUrl.php (lines 72–88), which uses PHP's filter_var() with FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE to reject non-public IP addresses. While the code correctly unwraps IPv4-mapped IPv6 (::ffff:x.x.x.x), PHP's built-in filter flags do not classify IPv6 transition address families — NAT64 (64:ff9b::/96, RFC 6052), 6to4 (2002::/16, RFC 3056), and Teredo (2001:0000::/32, RFC 4380) — as private or reserved, so addresses encoding private IPv4 targets pass validation unchecked. The bypass also applies through DNS resolution: if an attacker controls a DNS zone, they can return an AAAA record containing a transition address, which the resolveHost method passes to the same flawed isPublicIp check. Exploitation requires super-admin privileges to configure webhook URLs (GitHub Advisory).

A super-admin who configures a webhook URL using an IPv6 transition address can cause the snipe-it server to make requests to internal services or cloud metadata endpoints that should be inaccessible from external contexts. Concrete impacts include reading cloud instance metadata (e.g., AWS/GCP/Azure IMDS at 169.254.169.254), accessing services on private internal networks, and conducting port scans of internal infrastructure. Confidentiality impact is rated High (sensitive internal data exposure), integrity impact is Low, and there is no direct availability impact (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.0025 (0.25%), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for super-admin privileges and the need for the host to be operating in a NAT64-, 6to4-, or Teredo-enabled network environment (GitHub Advisory).

1. Obtain super-admin access: Gain super-admin credentials to the snipe-it instance through legitimate means, credential theft, or privilege escalation.
2. Identify target internal resource: Determine the internal IP address or cloud metadata endpoint to target (e.g., AWS IMDS at 169.254.169.254, or an internal service at 10.0.0.1).
3. Craft an IPv6 transition address: Encode the target private IPv4 address into one of the three supported transition formats:
   • NAT64: http://[64:ff9b::a9fe:a9fe]/latest/meta-data/ (encodes 169.254.169.254)
   • 6to4: http://[2002:7f00:1::]/ (encodes 127.0.0.1)
   • Teredo: http://[2001:0000:4136:e378:8000:63bf:f5ff:fffe]/ (encodes 10.0.0.1 via XOR with 0xffffffff)
4. Configure webhook URL: Navigate to the webhook configuration in snipe-it's admin panel and set the webhook URL to the crafted IPv6 transition address.
5. Trigger webhook: Initiate an action in snipe-it that fires the webhook (e.g., an asset update or alert event), causing the server to make an HTTP request to the internal target.
6. Retrieve response: Collect the server's response, which may contain cloud metadata tokens, internal service data, or other sensitive information (GitHub Advisory).

• Network: Outbound HTTP requests from the snipe-it server to 169.254.169.254 (AWS/GCP/Azure IMDS) or other RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); outbound connections to IPv6 addresses in the 64:ff9b::/96, 2002::/16, or 2001:0000::/32 prefixes.
• Logs: Application or web server logs showing webhook delivery attempts to IPv6 literal URLs containing transition address prefixes (e.g., [64:ff9b::, [2002:, [2001:0000:); unexpected HTTP responses from internal endpoints logged by the snipe-it webhook subsystem.
• Configuration: Webhook URLs in the snipe-it admin panel set to IPv6 literals or hostnames resolving to AAAA records in NAT64/6to4/Teredo ranges; recent changes to webhook configuration by super-admin accounts.

Upgrade snipe-it to version 8.7.0 or later, which includes a fix that extracts the embedded IPv4 address from NAT64, 6to4, and Teredo transition addresses before re-validating against private/reserved ranges. As interim mitigations: restrict super-admin role assignment to the minimum number of trusted users; implement network-level egress filtering on the snipe-it server to block outbound requests to RFC 1918 addresses and cloud metadata endpoints (169.254.169.254); and monitor webhook configurations for suspicious IPv6 transition address patterns (GitHub Advisory).

The vulnerability was discovered and reported by security researcher tonghuaroot (GitHub: @tonghuaroot) and was published as a GitHub Security Advisory (GHSA-5j6m-rr83-rpj7) by the snipe-it maintainers on August 24, 2026. The advisory was assigned a "Moderate" severity rating by the project. No significant broader media coverage or notable community discussion beyond standard CVE aggregator indexing has been observed (GitHub Advisory).