HomeBox versions before 0.26.0 have a SSRF vulnerability due to the default-on BlockBogonNets and BlockCloudMetadata notifier protections not inspecting IPv4 destinations embedded in NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An authenticated user can submit a generic:// notifier via POST endpoints, and on instances using NAT64/DNS64 egress, the gateway translates IPv6 destinations to internal IPv4 hosts such as cloud metadata services or localhost. The notifier test endpoint returns delivery results, which can disclose sensitive metadata like temporary credentials. Without NAT64 egress, the crafted IPv6 addresses are unroutable but still incorrectly classified as safe. This vulnerability is addressed in HomeBox 0.26.0.

An authenticated user can exploit this SSRF vulnerability to access internal IPv4 resources such as cloud metadata services or localhost through NAT64 translation. This can lead to disclosure of sensitive information including temporary credentials. The vulnerability does not allow unauthenticated access and requires the attacker to have some level of privilege. The CVSS 4.0 score is 6.0 (medium severity), reflecting network attack vector, low attack complexity, and high confidentiality impact.

Upgrade HomeBox to version 0.26.0 or later, where this SSRF vulnerability is fixed. No other mitigation is indicated by the vendor advisory. If upgrading is not immediately possible, restrict authenticated user access to the notifier endpoints and avoid NAT64/DNS64 egress configurations where feasible.