Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js's URL parser normalizes IPv4-mapped IPv6 addresses to compressed hex form (e.g., ::ffff:169.254.169.254 becomes ::ffff:a9fe:a9fe), but the isPrivateIp utility only recognizes the dotted-decimal notation. As a result, the hex form passes the SSRF check unchecked. Additionally, the socket lookup validation event does not fire for IP literal addresses, bypassing the second validation layer. An authenticated user can reach any internal IP, including cloud metadata endpoints, to exfiltrate credentials such as IAM keys.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-33975 SSRF Protection Bypass in Twenty CRM via IPv4-Mapped IPv6 Addresses https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33975
Post summary
The text announces CVE‑2026‑33975, detailing an SSRF bypass in Twenty CRM that exploits IPv4‑mapped IPv6 addresses, but no PoC, exploit code, active exploitation, or patch information is provided.
🚨*CVE* CVE-2026-33975 Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypass… https://www.cve.org/CVERecord?id=CVE-2026-33975 ----- Traducción: CVE-2026-33975 Twe… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑33975, describing an SSRF bypass vulnerability in older releases of the open‑source CRM Twenty, and directs readers to the official CVE record.
CVE-2026-33975 Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypass… https://www.cve.org/CVERecord?id=CVE-2026-33975
Post summary
An SSRF bypass vulnerability (CVE-2026-33975) has been disclosed for the open‑source CRM Twenty, affecting versions 1.18.0 and earlier, with no exploit code or patch noted.