# CVE-2026-86735: snipe-it ExternalUrl SSRF via IPv6 transition address bypass

Source: https://junglewise.ai/threats/cve-2026-86735-snipe-it-externalurl-ssrf-via-ipv6-transition-address-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86735 · Severity: medium · CVSS 5 · Published 2026-09-08

snipe-it is an open-source asset management system used to track IT inventory and hardware across organizations. The system contains a flaw in its webhook URL validation that allows administrators with super-admin privileges to bypass SSRF (server-side request forgery) protections by using specially crafted IPv6 addresses that secretly target internal systems or cloud metadata endpoints. An attacker with super-admin access could read sensitive cloud credentials, access internal services, or scan private infrastructure.

Technologies: [Snipeitapp Snipe-It](https://junglewise.ai/threats/technologies/snipe-it). Vendors: [Snipeitapp](https://junglewise.ai/threats/vendors/snipeitapp).

## Quick answers

**Is CVE-2026-86735 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86735 being exploited in the wild.

**How severe is CVE-2026-86735?** Medium severity, with a CVSS score of 5, published 8 September 2026.

**Which products and versions are affected?** grokability snipe-it before 8.7.0.

**Is there a fix for CVE-2026-86735?** A patch was published on 2026-08-24: Fix available in version 8.7.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86735 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86735?** Check whether you run Snipeitapp Snipe-It. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a server-side request forgery (SSRF) bypass in the ExternalUrl validation rule (app/Rules/ExternalUrl.php). The isPublicIp method attempts to validate webhook URLs by unwrapping IPv4-mapped IPv6 addresses (::ffff:x.x.x.x) and using PHP's filter_var with FILTER_FLAG_NO_PRIV_RANGE and FILTER_FLAG_NO_RES_RANGE flags. However, PHP's built-in filters do not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, and Teredo 2001:0000::/32) as private or reserved, even though they encode private IPv4 targets in their lower bits. Attack vector is network with high complexity; requires super-admin privileges. An authenticated super-admin can supply an IPv6 literal or DNS record containing a transition address, which bypasses validation and allows the webhook to access internal systems, AWS/GCP/Azure metadata endpoints (169.254.169.254), or perform port scanning. The fix requires extracting the embedded IPv4 address from transition addresses and re-validating them. Patched in version 8.7.0.

## Affected products

- grokability snipe-it before 8.7.0

## Timeline

- 2026-08-24: disclosed: GitHub Security Advisory GHSA-5j6m-rr83-rpj7 published
- 2026-09-08: advisory: CVE-2026-86735 published on NVD
- 2026-08-24: patched: Fix available in version 8.7.0

## References

- [https://github.com/grokability/snipe-it/security/advisories/GHSA-5j6m-rr83-rpj7](https://github.com/grokability/snipe-it/security/advisories/GHSA-5j6m-rr83-rpj7)
- [https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-via-ipv6-transition-address-bypass](https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-ssrf-via-ipv6-transition-address-bypass)

## Related threats

- [Snipe-IT broken access control in Asset Model file attachments](https://junglewise.ai/threats/cve-2026-86774-snipe-it-broken-access-control-in-asset-model-file-attachments)
- [Snipe-IT broken access control in Predefined Kit endpoints](https://junglewise.ai/threats/cve-2026-86773-snipe-it-broken-access-control-in-predefined-kit-endpoints)
- [Snipe-IT stored cross-site scripting in department names](https://junglewise.ai/threats/cve-2026-86772-snipe-it-stored-cross-site-scripting-in-department-names)
- [Snipe-IT acceptance PDF server-side request forgery via unescaped employee_num](https://junglewise.ai/threats/cve-2026-86771-snipe-it-acceptance-pdf-server-side-request-forgery-via-unescaped)
- [Snipe-IT authentication bypass in SAML username collation](https://junglewise.ai/threats/cve-2026-86770-snipe-it-authentication-bypass-in-saml-username-collation)