CVE-2026-55473Disclosure

LOWCVSS 6.0 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifier_url.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An authenticated user can submit a generic:// notifier through POST /v1/notifiers or POST /v1/notifiers/test, and on a Homebox instance that egresses through NAT64/DNS64, the gateway can translate an accepted IPv6 destination to cloud metadata, localhost, or another internal IPv4 host. The notifier test path returns delivery result information, and Shoutrrr propagates the response, providing feedback that can disclose retrieved metadata such as temporary credentials. Without NAT64 egress, the crafted IPv6 destination is not routable, but the guard still incorrectly classifies it as safe. This issue is fixed in version 0.26.0.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-21); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters28d
Disclosure
CVE-2026-55473 HomeBox SSRF: NAT64 IPv4 bypass in notifier URL checks. CVSS 7.7. Auth users can hit internal/metadata endpoints via generic:// notifiers. Patch under review, not yet released - watch for 0.26.x. https://www.valtersit.com/cve/CVE-2026-55473/ #CVE #infosec #cybersecurity #HomeBox #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post describes a HomeBox SSRF vulnerability, including its NAT64 bypass mechanism, impact, and CVSS score. A patch is under review but has not yet been released, so the main focus is disclosure rather than an available remediation.
0001055
1.1K followersView on X
CVE@CVEnew48d
Disclosure
CVE-2026-55473 HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/intern… https://www.cve.org/CVERecord?id=CVE-2026-55473
Post summary
The text announces CVE-2026-55473, an SSRF vulnerability in HomeBox prior to version 0.26.0, providing basic technical details about the affected component without mentioning exploits or patches.
00000853
58.1K followersView on X

Explore more

Back to dashboard