Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-88896: EspoCRM before 10.0.4 can be tricked to call internal services

CVE-2026-88896 · published 1 month ago

Summary

EspoCRM versions older than 10.0.4 allow specially crafted web addresses to bypass checks that should keep the system from reaching private network locations. An attacker who controls a domain can supply such an address and cause the CRM to contact internal servers, potentially exposing sensitive data. Upgrade to version 10.0.4 or later, or apply the vendor's patch, to stop this behavior.

What to do

Update espocrm espocrm to version 10.0.4 or later.

Affected software

Vendor	Product	Affected versions
espocrm	espocrm	< 10.0.4

Original advisory text

EspoCRM before 10.0.4 SSRF via IPv6 Transition Address Bypass

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services. Affected paths include POST /Attachment/fromImageUrl, reachable by any authenticated user with attachment access, and outbound webhook delivery, which requires an admin or API user.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88896... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-88896 Vendor Advisory
https://github.com/espocrm/espocrm/security/advisories/GHSA-xwmh-j8hf-cfqw Vendor Advisory
https://www.vulncheck.com/advisories/espocrm-before-10.0.4-ssrf-via-ipv6-transit... Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published10 Sep 2026

Updated4 Nov 2026

First seen10 Sep 2026

Sources

CVE-2026-88896 · NVD

CVE-2026-88896 · MITRE

CVE-2026-88896 · OSV

GHSA-xwmh-j8hf-cfqw · GHSA

Track software like this

Free during beta