Is CVE-2026-33975 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33975 being exploited in the wild.

How severe is CVE-2026-33975?

Informational severity, with a CVSS score of 8.3, published 5 May 2026.

Is there a fix for CVE-2026-33975?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33975 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33975?

Check whether you run Twenty Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33975: Twenty CRM SSRF bypass via IPv4-mapped IPv6 normalization

CVE-2026-33975 · Severity: info · CVSS 8.3 · Published 2026-05-05

Twenty, an open-source CRM platform, contains a security flaw that allows authenticated users to bypass protections designed to prevent the server from making unauthorized internal requests. By using specially formatted web addresses, an attacker can force the server to connect to private internal systems or cloud management services. This could lead to the theft of sensitive cloud credentials (such as AWS IAM keys) or unauthorized access to internal company data.

Vendors: Twenty.

Quick answers

Is CVE-2026-33975 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33975 being exploited in the wild.
How severe is CVE-2026-33975?: Informational severity, with a CVSS score of 8.3, published 5 May 2026.
Which products and versions are affected?: Twenty Server <= 1.18.0.
Is there a fix for CVE-2026-33975?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33975 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33975?: Check whether you run Twenty Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Twenty versions 1.18.0 and earlier due to a normalization mismatch between the Node.js URL parser and the application's 'isPrivateIp' utility. While the URL parser normalizes IPv4-mapped IPv6 addresses to compressed hexadecimal form (e.g., ::ffff:a9fe:a9fe), the validation utility only checks for dotted-decimal notation, allowing the hex-encoded private IPs to bypass security filters. Furthermore, because these are IP literals, the secondary socket lookup validation layer is bypassed as no DNS resolution occurs. An authenticated attacker can exploit this to reach internal services or cloud metadata services (IMDS) to exfiltrate sensitive credentials like IAM keys.

Affected products

twentyhq twenty-server <= 1.18.0

Timeline

2026-04-27: advisory: GitHub Security Advisory published by maintainers
2026-05-05: disclosed: CVE-2026-33975 published

References

https://github.com/twentyhq/twenty/security/advisories/GHSA-vrcj-hv2q-c58m

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.