CVE-2026-69192 is a vulnerability in the ip-address JavaScript library where IPv4 address octets with leading zeros are interpreted as decimal instead of octal, contrary to standard network parsers. This parsing discrepancy can cause applications to misclassify internal IP addresses as external, enabling attackers to bypass SSRF protections and potentially access internal systems. The issue affects proxy-agent versions prior to 7.0.0-r2, which includes Red Hat Hardened Images and related packages. Red Hat has released a security update (RHSA-2026:50854) that fixes this vulnerability. The vulnerability is tracked under CWE-1389 (Incorrect Parsing of Numbers with Different Radices).

The vulnerability can lead to Server-Side Request Forgery (SSRF) and trust-boundary bypass, allowing remote attackers to circumvent security filters designed to block access to internal network resources. This can result in unauthorized access to sensitive internal systems. The impact is rated high by Red Hat, with confidentiality impact but no integrity or availability impact reported. No known exploits in the wild have been documented.

A patch is available in proxy-agent version 7.0.0-r2 and related Red Hat Hardened Images RPMs. Users should update affected packages to the fixed version to remediate the vulnerability. Red Hat does not currently recommend alternative mitigations due to limitations in ease of use, applicability, or stability. Applying the official update is the primary remediation step.