Executive brief
snipe-it is an open-source asset management system used to track IT inventory and hardware across organizations. The system contains a flaw in its webhook URL validation that allows administrators with super-admin privileges to bypass SSRF (server-side request forgery) protections by using specially crafted IPv6 addresses that secretly target internal systems or cloud metadata endpoints. An attacker with super-admin access could read sensitive cloud credentials, access internal services, or scan private infrastructure.
Technical details
The vulnerability is a server-side request forgery (SSRF) bypass in the ExternalUrl validation rule (app/Rules/ExternalUrl.php). The isPublicIp method attempts to validate webhook URLs by unwrapping IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) and using PHP's filter_var with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE flags. However, PHP's built-in filters do not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, and Teredo 2001:0000::/32) as private or reserved, even though they encode private IPv4 targets in their lower bits. Attack vector is network with high complexity; requires super-admin privileges. An authenticated super-admin can supply an IPv6 literal or DNS record containing a transition address, which bypasses validation and allows the webhook to access internal systems, AWS/GCP/Azure metadata endpoints (169.254.169.254), or perform port scanning. The fix requires extracting the embedded IPv4 address from transition addresses and re-validating them. Patched in version 8.7.0.
Affected products
- grokability snipe-it before 8.7.0
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-5j6m-rr83-rpj7 published
- 2026-09-08: advisory: CVE-2026-86735 published on NVD
- 2026-08-24: patched: Fix available in version 8.7.0