CVE-2026-114730
published 2026-10-22CVE-2026-114730: Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by…
PriorityP344high7.2CVSS 3.1
AVNACLPRNUINSCCLILAN
EPSS
0.31%
23.9th percentile
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.14 < 1.6.20 | 1.6.20 |
| roundcube | webmail | >= 1.7.0 < 1.7.5 | 1.7.5 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.
ghsa_unreviewed·2026-10-22
CVE-2026-114730 [HIGH] CWE-918 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Red Hat
roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass
vendor_redhat·2026-10-22·CVSS 7.2
CVE-2026-114730 [HIGH] CWE-918 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass
roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
A flaw was found in Roundcube Webmail. The application's internal URL validation mechanism fails to properly block certain IPv6 address representations, including transition pr
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass
bugzilla·2026-10-22·CVSS 7.2
CVE-2026-114730 [HIGH] CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass
CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Bugzilla
CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass [epel-all]
bugzilla·2026-10-22·CVSS 7.2
CVE-2026-114730 [HIGH] CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass [epel-all]
CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in th
Bugzilla
CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass [fedora-all]
bugzilla·2026-10-22·CVSS 7.2
CVE-2026-114730 [HIGH] CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass [fedora-all]
CVE-2026-114730 roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in
https://bugs.debian.org/1151279https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090https://github.com/roundcube/roundcubemail/commit/6e1d480e730a45f29829b6a11af608d5d6eb3db6https://github.com/roundcube/roundcubemail/releases/tag/1.6.20https://github.com/roundcube/roundcubemail/releases/tag/1.7.5https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
2026-10-22
Published