Is CVE-2026-86735 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86735 being exploited in the wild.

How severe is CVE-2026-86735?

Medium severity, with a CVSS score of 5, published 8 September 2026.

Which products and versions are affected?

grokability snipe-it before 8.7.0.

Is there a fix for CVE-2026-86735?

A patch was published on 2026-08-24: Fix available in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86735 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86735?

Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86735: snipe-it ExternalUrl SSRF via IPv6 transition address bypass

CVE-2026-86735 · Severity: medium · CVSS 5 · Published 2026-09-08

snipe-it is an open-source asset management system used to track IT inventory and hardware across organizations. The system contains a flaw in its webhook URL validation that allows administrators with super-admin privileges to bypass SSRF (server-side request forgery) protections by using specially crafted IPv6 addresses that secretly target internal systems or cloud metadata endpoints. An attacker with super-admin access could read sensitive cloud credentials, access internal services, or scan private infrastructure.

Technologies: Snipeitapp Snipe-It. Vendors: Snipeitapp.

Quick answers

Is CVE-2026-86735 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86735 being exploited in the wild.
How severe is CVE-2026-86735?: Medium severity, with a CVSS score of 5, published 8 September 2026.
Which products and versions are affected?: grokability snipe-it before 8.7.0.
Is there a fix for CVE-2026-86735?: A patch was published on 2026-08-24: Fix available in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86735 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86735?: Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a server-side request forgery (SSRF) bypass in the ExternalUrl validation rule (app/Rules/ExternalUrl.php). The isPublicIp method attempts to validate webhook URLs by unwrapping IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) and using PHP's filter_var with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE flags. However, PHP's built-in filters do not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, and Teredo 2001:0000::/32) as private or reserved, even though they encode private IPv4 targets in their lower bits. Attack vector is network with high complexity; requires super-admin privileges. An authenticated super-admin can supply an IPv6 literal or DNS record containing a transition address, which bypasses validation and allows the webhook to access internal systems, AWS/GCP/Azure metadata endpoints (169.254.169.254), or perform port scanning. The fix requires extracting the embedded IPv4 address from transition addresses and re-validating them. Patched in version 8.7.0.

Affected products

grokability snipe-it before 8.7.0

Timeline

2026-08-24: disclosed: GitHub Security Advisory GHSA-5j6m-rr83-rpj7 published
2026-09-08: advisory: CVE-2026-86735 published on NVD
2026-08-24: patched: Fix available in version 8.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.