CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114730?
CVE-2026-114730 is a high-severity vulnerability in Roundcube Webmail, published on 22 Oct 2026.
Official description
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96”.
Weakness: CWE-918
Which versions are affected by CVE-2026-114730?
How do I fix CVE-2026-114730?
Upgrade to a fixed version.
Is CVE-2026-114730 being exploited?
There is no known exploitation of CVE-2026-114730 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-114730, GHSA-8f6h-w7cq-8q8h, UBUNTU-CVE-2026-114730.