Quick answers
- Is CVE-2026-82476 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-82476 being exploited in the wild.
- How severe is CVE-2026-82476?
- Medium severity, with a CVSS score of 5.3, published 29 August 2026.
- Which products and versions are affected?
- Usememos Memos through 0.30.0.
- Is there a fix for CVE-2026-82476?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-82476 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-82476?
- Check whether you run Usememos Memos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) weakness in the link-metadata fetcher component (html_meta.go in internal/httpgetter). The IP validation logic fails to include the 100.64.0.0/10 carrier-grade NAT (CGN) address range in its blocklist of internal/reserved IP ranges, which is commonly used by cloud providers (AWS, GCP, Azure) for metadata services and internal networking. An unauthenticated attacker can craft a memo containing a URL pointing to an internal IP in the 100.64.0.0/10 range; when the server fetches metadata, it makes an outbound request to that address and returns page titles and descriptions. This allows attackers to probe cloud metadata endpoints (e.g., 169.254.169.254 equivalents), enumerate internal services, or extract sensitive information. The vulnerability requires no authentication and can be triggered by any user able to add links to memos.
Affected products
- usememos Memos through 0.30.0
Timeline
- 2026-08-29: disclosed