CVE-2026-63096 is an SSRF vulnerability in matrix-org's Dendrite server software affecting versions up to 0.13.8. Attackers can supply an unvalidated serverName parameter to the legacy media download endpoint, causing the server to open outbound TLS connections to arbitrary external or internal hosts and ports. The vulnerability also leaks internal IP addresses through error messages, which can be used for blind port scanning and internal network enumeration. The vulnerability requires no authentication and has a medium CVSS score of 6.9. No official patch or remediation level has been published as of the data provided.

An unauthenticated attacker can abuse this SSRF vulnerability to make the server connect to arbitrary hosts and ports over TLS, potentially accessing internal network resources not otherwise reachable. The leakage of internal IP addresses and error response distinctions can facilitate reconnaissance activities such as blind port scanning and network topology mapping. This could lead to further targeted attacks within the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting outbound connections from the Dendrite server to trusted hosts and ports, and monitor for unusual outbound TLS connection attempts originating from the server. Avoid exposing the legacy media download endpoint if possible.