Threats Tagged 'ghsa-pph6-vfjv-vpjw'
View all threats tagged with 'ghsa-pph6-vfjv-vpjw'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-pph6-vfjv-vpjw'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-pph6-vfjv-vpjw: ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gatewayCVE-2026-54450 0 ToolHive's SSRF protection function fails to recognize IPv6 NAT64 address ranges (64:ff9b::/96 and 64:ff9b:1::/48) as private, allowing connections to internal or link-local addresses behind a NAT64 gateway. This flaw enables an attacker controlling a URL parameter in the OAuth authorization server to bypass SSRF guards and cause ToolHive to connect to internal metadata or other protected addresses. The vulnerability primarily results in blind internal reachability probing rather than direct data leakage, as the attacker cannot control or view responses. The issue affects all ToolHive versions prior to 0.29.1. No patch information is provided, so patch status is unconfirmed. Join the discussion | GCVE Database | 07/15/2026, 21:51:03 UTC Added: 07/16/2026, 10:36:06 UTC |
Showing 1 to 1 of 1 result