CVE-2026-63088: stoatchat SSRF via DNS blocklist bypass in January proxy

CVE-2026-63088 · Severity: high · CVSS 8.6 · Published 2026-07-16

Stoatchat, an open-source communication platform, contains a security flaw in its 'January' media proxy and embed service. This vulnerability allows an unauthorized person to trick the server into making requests to internal systems that should be private, such as internal databases or cloud metadata services. This could lead to the exposure of sensitive internal data or credentials, potentially compromising the entire server infrastructure.

Technologies: Stoatchat. Vendors: Stoatchat.

Quick answers

Is CVE-2026-63088 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63088 being exploited in the wild.
How severe is CVE-2026-63088?
High severity, with a CVSS score of 8.6, published 16 July 2026.
Which products and versions are affected?
Stoatchat Revolt-January <= v0.13.7; Stoatchat < 0.14.0.
Is there a fix for CVE-2026-63088?
A patch was published on 2026-07-15: Version 0.14.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63088 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63088?
Check whether you run Stoatchat Revolt-January or Stoatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A server-side request forgery (SSRF) vulnerability exists in the 'January' service of stoatchat (specifically the /proxy and /embed endpoints) due to incomplete DNS resolution validation. The 'url_is_blacklisted' function in 'crates/services/january/src/requests.rs' only validates the first IP address returned by a DNS query. However, the underlying HTTP client (reqwest) iterates through all resolved addresses if the first one fails. An attacker can exploit this by providing a hostname that resolves to multiple A records: an unreachable public IP (to pass the check) followed by a restricted internal or loopback IP. This allows unauthenticated network-accessible attackers to bypass the IP blocklist and reach internal services, including instance metadata endpoints (IMDS) in cloud environments. The issue is fixed in version 0.14.0.

Affected products

  • stoatchat stoatchat < 0.14.0
  • stoatchat revolt-january <= v0.13.7

Timeline

  • 2026-07-13: advisory: GHSA-4mcc-p83c-r77q published
  • 2026-07-15: patched: Version 0.14.0 released
  • 2026-07-16: disclosed: CVE-2026-63088 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.