CVE-2026-73087: Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

September 8, 2026

The isBlockedIP SSRF guard in Dozzle’s webhook notification dispatcher blocks loopback, link-local, multicast, and unspecified addresses but does not recognize IPv6 transition mechanism addresses (RFC 3056 6to4, RFC 6052 NAT64, RFC 4380 Teredo) that embed arbitrary IPv4 addresses. An authenticated user can bypass the guard to reach loopback services, cloud metadata endpoints (169.254.169.254), and other blocked ranges via webhook notification URLs.

References

github.com/advisories/GHSA-p2w3-6x73-2f6x
github.com/amir20/dozzle/commit/8cf7ccd5ee041ecaea92b49951793d4d2393761f
github.com/amir20/dozzle/pull/4887
github.com/amir20/dozzle/releases/tag/v10.6.15
github.com/amir20/dozzle/security/advisories/GHSA-p2w3-6x73-2f6x
nvd.nist.gov/vuln/detail/CVE-2026-73087

Code Behaviors & Features

Detect and mitigate CVE-2026-73087 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →