Is CVE-2026-72761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72761 being exploited in the wild.

How severe is CVE-2026-72761?

Informational severity, with a CVSS score of 0, published 10 August 2026.

Which products and versions are affected?

Vulnerability Lookup HEAD (non-release versions only).

Is there a fix for CVE-2026-72761?

A patch was published on 2026-08-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72761 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-72761?

Check whether you run Vulnerability Lookup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72761: Vulnerability Lookup webhook SSRF bypass via IPv6 transition addresses

CVE-2026-72761 · Severity: info · CVSS 0 · Published 2026-08-10

The webhook validation system in Vulnerability Lookup's notification service fails to properly block requests to private and internal endpoints by incorrectly classifying certain IPv6 transition addresses (such as NAT64, 6to4, and Teredo) as public. An authenticated attacker can register a webhook pointing to a hostname that resolves to these transition addresses to bypass security restrictions and exfiltrate vulnerability data to internal systems, including metadata endpoints used by cloud infrastructure.

Technologies: Vulnerability Lookup. Vendors: Vulnerability Lookup.

Quick answers

Is CVE-2026-72761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72761 being exploited in the wild.
How severe is CVE-2026-72761?: Informational severity, with a CVSS score of 0, published 10 August 2026.
Which products and versions are affected?: Vulnerability Lookup HEAD (non-release versions only).
Is there a fix for CVE-2026-72761?: A patch was published on 2026-08-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72761 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-72761?: Check whether you run Vulnerability Lookup at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in `website/notifications/webhooks.py`, where the webhook URL validator uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`, and IPv4-mapped addresses) are classified as globally routable by IANA, causing `is_global` to return `True` even when the embedded IPv4 address targets private ranges, loopback addresses, or cloud metadata services. The attack requires an authenticated user and a network where DNS resolution can be performed, but the subsequent DNS-pinning defense does not prevent delivery to the malicious target. The fix, already merged to HEAD, extracts the embedded IPv4 from transition addresses and rejects targets when that IPv4 is not globally routable, while still allowing legitimate transition addresses pointing to public IPv4 endpoints.

Affected products

Vulnerability Lookup Vulnerability Lookup HEAD (non-release versions only)

Timeline

2026-08-10: disclosed
2026-08-10: patched

References

https://github.com/vulnerability-lookup/vulnerability-lookup/commit/f3e0c6899c5b3823dcfd860fc6cb3edbedc9bf65

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.