VulnSocial

CVE-2026-67201Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-436

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 2 mentions (2026-07-29); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-29: 2Mentions · 2026-07-30: 1Patch / Workaround · 2026-07-29: 2Technical Details · 2026-07-29: 2Technical Details · 2026-07-30: 107-2907-30
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-292
Disclosure1Patch1
2026-07-301
Disclosure1
Full discourse3 posts
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨High - v SSRF Allowlists Bypass via URL Backslash Normalization (CVE-2026-67201) v validates URLs with net.urllib.parse() against a host allowlist, but net.http.get() normalizes a backslash in the authority and connects to a different internal host. A crafted URL can pass allowlist checks then pivot to internal services via SSRF. 👉Affected: v <= 0.5.2

    Post summary

    High‑severity SSRF allowlist bypass in v <=0.5.2 due to backslash normalization, enabling pivot to internal services.

    0000061
    275 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-67201 V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists… https://www.cve.org/CVERecord?id=CVE-2026-67201 ----- Traducción: CVE-2026-67201 V h… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-67201, details an SSRF bypass flaw, notes its fix in a specific commit, and links to the CVE record.

    0000030
    96 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-67201 V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists… https://www.cve.org/CVERecord?id=CVE-2026-67201

    Post summary

    CVE‑2026‑67201 is an SSRF bypass vulnerability affecting versions up to 0.5.2; it has been patched in commit 85859f0.

    00000565
    57.9K followersView on X

Explore more

Back to dashboard