# CVE-2026-55473: HomeBox notifier SSRF in DNS64/NAT64 environments

Source: https://junglewise.ai/threats/cve-2026-55473-homebox-is-a-home-inventory-and-organization-system-prior-to-0-26  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-55473 · Severity: info · Published 2026-09-21

HomeBox is a home inventory management system that allows users to configure notification services. An authenticated user on an instance using DNS64/NAT64 networking can exploit incomplete validation of IPv6 addresses to craft requests that access cloud metadata, localhost services, or internal hosts through the notifier feature. The notifier test endpoint returns delivery results that may disclose temporary credentials or other sensitive metadata from accessed services.

Technologies: [HomeBox](https://junglewise.ai/threats/technologies/homebox-homebox). Vendors: [HomeBox](https://junglewise.ai/threats/vendors/homebox).

## Quick answers

**Is CVE-2026-55473 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55473 being exploited in the wild.

**How severe is CVE-2026-55473?** Informational severity, published 21 September 2026.

**Which products and versions are affected?** HomeBox before 0.26.0.

**Is there a fix for CVE-2026-55473?** A patch was published on 2026-06-10: Fix committed with DNS64Nets configuration support Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55473 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55473?** Check whether you run HomeBox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SSRF protection in the notifier URL validation (backend/internal/sys/validate/notifier_url.go) fails to recognize IPv4 addresses embedded in NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, allowing an authenticated attacker to submit generic:// notifier URLs targeting internal resources. On instances with NAT64/DNS64 egress, the gateway translates these IPv6 destinations to cloud metadata or internal IPv4 hosts; the notifier test path (POST /v1/notifiers/test) returns delivery results through Shoutrrr that can leak accessed metadata. Without NAT64 egress, the addresses are non-routable but still incorrectly pass validation.

## Affected products

- HomeBox HomeBox before 0.26.0

## Timeline

- 2026-09-21: disclosed
- 2026-06-10: patched: Fix committed with DNS64Nets configuration support

## References

- [https://github.com/sysadminsmedia/homebox/commit/42c52f7f7566b7fbd8017352187af20f552a4471](https://github.com/sysadminsmedia/homebox/commit/42c52f7f7566b7fbd8017352187af20f552a4471)
- [https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0](https://github.com/sysadminsmedia/homebox/releases/tag/v0.26.0)

## Related threats

- [HomeBox stored XSS in custom fields via javascript: URI scheme](https://junglewise.ai/threats/cve-2026-75599-homebox-is-a-home-inventory-and-organization-system-prior-to-0-27)
- [HomeBox missing authorization in group membership endpoint](https://junglewise.ai/threats/cve-2026-48974-homebox-is-a-home-inventory-and-organization-system-prior-to-0-26)