CVE-2026-33975 twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization
Authenticated attackers can bypass SSRF protections using IPv4-mapped IPv6 addresses to access internal networks and steal cloud credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-33975?
CVE-2026-33975 is a high-severity server-side request forgery vulnerability in twentyhq twenty, published on 5 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js's URL parser normalizes IPv4-mapped IPv6 addresses to compressed hex form (e.g., ::ffff:169.254.169.254 becomes ::ffff:a9fe:a9fe), but the isPrivateIp utility only recognizes the dotted-decimal notation. As a result, the hex form passes the SSRF check unchecked. Additionally, the socket lookup validation event does not fire for IP literal addresses, bypassing the second validation layer. An authenticated user can reach any internal IP, including cloud metadata endpoints, to exfiltrate credentials such as IAM keys.
Weakness: CWE-918
Which versions are affected by CVE-2026-33975?
How do I fix CVE-2026-33975?
No fix has been published for CVE-2026-33975 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-33975 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33975 exists.
Sources
Also known as GHSA-vrcj-hv2q-c58m.