Log in Start free

Vulnerability · Published Aug 11, 2026 · Assigned by GitHub_M

CVE-2026-73212coturn peer-IP ACL canonicalization & scope bypass on the RFC 6062 TCP CONNECT relay path → internal-network SSRF and proven internal root RCE

Medium 5.8

In plain English

A medium-severity improper access control in coturn from coturn. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.8Medium
Exploit odds (30 days)0.5%top 57.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12coturnno fix listedDEBIAN-CVE-2026-73212
Debian:13coturnno fix listedDEBIAN-CVE-2026-73212
Debian:14coturn4.14.0-1DEBIAN-CVE-2026-73212
Ubuntu:22.04:LTScoturnno fix listedUBUNTU-CVE-2026-73212
Ubuntu:24.04:LTScoturnno fix listedUBUNTU-CVE-2026-73212
Ubuntu:26.04:LTScoturnno fix listedUBUNTU-CVE-2026-73212

Affected products (as reported)

VendorProductVersions
coturn coturn < 4.13.1

Weakness: CWE-284, CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

References