CVE-2026-100251CWE-918ssrf

CVE-2026-100251

Medium · published October 2, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-10-02T00:17Z
References (3)
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-04.json · 9119a7d8-5eab-497f-8521-727c672e3725https://wormhole.app/ · 9119a7d8-5eab-497f-8521-727c672e3725https://www.cve.org/CVERecord?id=CVE-2026-100251 · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 03 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 01 OCT 19:44Z
    Wormhole.app SSRF
    cvelistv5