CVE-2026-82476CWE-918ssrf

CVE-2026-82476

Medium · published August 29, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-29T21:18Z
References (5)
https://github.com/usememos/memos · [email protected]https://github.com/usememos/memos/blob/v0.30.0/internal/httpgetter/html_meta.go · [email protected]https://github.com/usememos/memos/issues/6099 · [email protected]https://www.vulncheck.com/advisories/memos-through-0.30.0-ssrf-via-omitted-cgnat-address-range · [email protected]https://github.com/usememos/memos/issues/6099 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 16:35Z
    Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
    cvelistv5