Vulnerability · Published Sep 8, 2026 · Assigned by VulnCheck

CVE-2026-86735snipe-it before 8.7.0 SSRF via IPv6 transition address bypass

Medium 5.0

In plain English

A medium-severity server-side request forgery in snipe-it from grokability. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.3%top 75.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo transition addresses to bypass SSRF guards and access internal services or cloud metadata endpoints.

Affected products (as reported)

Vendor	Product	Versions
grokability	snipe-it	0 – before 8.7.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-5j6m-rr83-rpj7) vendor-advisory
VulnCheck Advisory: snipe-it before 8.7.0 SSRF via IPv6 transition address bypass third-party-advisory