Wormhole.app versions prior to 2026-08-22 contain a SSRF vulnerability due to improper configuration of the coturn TURN server. This misconfiguration permits unauthenticated attackers to leverage the TCP relay functionality to access sensitive instance metadata or to source TCP connections using the Wormhole relay's IP address. The vulnerability is identified as CWE-918 and has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No known exploits in the wild have been reported. The affected versions are all releases from 0 up to but not including 2026-08-22.

An unauthenticated attacker can exploit this SSRF vulnerability to access instance metadata or to initiate TCP connections from the Wormhole relay's IP address. This could potentially lead to information disclosure and unauthorized network access originating from the relay server. There is no indication of impact on availability, and integrity impact is limited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is due to a misconfiguration of the coturn TURN server, remediation likely involves correcting the TCP relay peer restrictions. Until an official fix or patch is released, administrators should review and tighten TURN server configurations to restrict unauthorized TCP relay access.