CVE-2026-79659: Server-Side Request Forgery (SSRF) in lin-snow Ech0

CVE-2026-79659 is a server-side request forgery vulnerability affecting lin-snow Ech0 versions prior to 4.7.3. The issue exists in the fetchPeerConnectInfo function, which improperly handles HTTP requests by not validating URLs before use. Authenticated attackers can exploit this to make the server perform requests to arbitrary URLs, including internal network services and cloud metadata endpoints, by triggering connection health checks or peer connection operations. This can lead to unauthorized access to sensitive internal resources.

An authenticated attacker can exploit this SSRF vulnerability to access internal services and cloud metadata endpoints that are normally inaccessible externally. This can lead to information disclosure and potentially further attacks leveraging internal network trust. The CVSS 4.0 score of 8.3 (high severity) reflects the network attack vector, low attack complexity, and high impact on confidentiality and security capabilities.

A fix is available in Ech0 version 4.7.3. Users should upgrade to version 4.7.3 or later to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the affected version range indicating fixed in 4.7.3. Until upgrading, restrict authenticated user access to trusted parties to reduce exploitation risk.