Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-63096Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint

Medium 5.8

In plain English

A medium-severity server-side request forgery in dendrite from matrix-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.

Affected products (as reported)

Vendor	Product	Versions
matrix-org	dendrite	0 – through 0.13.8

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/dendrite-ssrf-via-unauthenticated-legacy-media-download-endpoint third-party-advisory