CVE-2026-63096 Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint
Unauthenticated attackers can exploit an SSRF vulnerability in Dendrite to scan internal networks and leak internal IP addresses via the legacy media download endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63096?
CVE-2026-63096 is a medium-severity server-side request forgery vulnerability in matrix-org dendrite, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dendrite through 0.13.8 contains a server-side request forgery vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.
Weakness: CWE-918
Which versions are affected by CVE-2026-63096?
How do I fix CVE-2026-63096?
No fix has been published for CVE-2026-63096 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-63096 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63096 exists.
Sources
Also known as GHSA-jrcq-4ccj-6fr8.