CVE-2026-70367 is an SSRF bypass vulnerability in stunnel 5.79 and lower when configured with the non-default setting "protocol = socks". The flaw allows clients to circumvent intended localhost access restrictions by using IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) or unspecified addresses (0.0.0.0, ::), enabling access to loopback-only services on the stunnel host. Since SOCKS proxying is a general-purpose network access facility, exploitation requires network access to the SOCKS proxy and depends on the existence of local services bound to localhost. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).

An attacker with access to the stunnel SOCKS proxy can bypass localhost restrictions and access services bound to the local interface of the stunnel host that are not intended to be network-reachable. This could lead to unauthorized information disclosure or limited unauthorized command execution depending on the local services exposed. The overall impact is rated as low confidentiality and integrity impact with no availability impact.

If SOCKS proxying is not required, disable the "protocol = socks" configuration in stunnel. If SOCKS proxying is necessary, restrict access to the SOCKS listener by binding it to a trusted management network or localhost, enforce client authentication or network ACLs, run stunnel in isolated containers or network namespaces without other localhost services, and apply firewall rules to restrict outgoing connections from stunnel to localhost. No official patch or fix is currently confirmed; patch status is not yet confirmed — check the vendor advisory for updates.