CVE-2026-70367 is an SSRF bypass vulnerability in stunnel versions up to 5.79 when configured in SOCKS proxy mode. The issue arises because the SOCKS proxy improperly handles IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) and unspecified addresses (0.0.0.0, ::), allowing clients to circumvent intended localhost access restrictions. This can expose loopback-only services on the stunnel host to network access via the SOCKS proxy. The vulnerability requires the 'protocol = socks' configuration, which is not enabled by default. Exploitation depends on the local services bound to localhost and the network environment. The CVSS v3.1 base score assigned by Red Hat is 5.4 (medium severity) with low attack complexity and low privileges required.

An attacker able to reach the stunnel SOCKS proxy can bypass localhost restrictions and access services bound to the local interface of the stunnel host that should not be reachable externally. This could lead to unauthorized information disclosure or unauthorized command execution depending on the local services exposed. The overall impact is limited by the requirement that the SOCKS proxy is enabled and accessible, and by the presence of vulnerable local services.

If SOCKS proxy functionality is not required, disable the 'protocol = socks' setting in stunnel. If SOCKS proxying is necessary, restrict access to the SOCKS listener by binding it to a trusted management network or localhost only, and enforce client authentication or network ACLs. Running stunnel in a container or network namespace isolated from other local services or applying firewall rules to restrict outgoing connections from stunnel to localhost can further mitigate the risk. There is no explicit vendor patch link provided; check the vendor advisory for updates and fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.