CVE-2026-73212 Server-side request forgery in coturn
An authenticated attacker can bypass peer IP restrictions via IPv6 canonicalization flaws to perform SSRF and achieve remote code execution on the internal network.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73212?
CVE-2026-73212 is a medium-severity server-side request forgery vulnerability in coturn, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.1, good_peer_addr() in src/server/ns_turn_server.c uses ioa_addr_in_range() in src/client/ns_turn_ioaddr.c without canonicalizing IPv4-compatible, 6to4, and 64:ff9b::/96 NAT64 address forms, allowing an authenticated RFC 6062 TCP CONNECT relay client to bypass an IPv4 denied-peer-ip range when the Coturn host has a useful translation route. This issue is fixed in version 4.13.1.
Which versions are affected by CVE-2026-73212?
How do I fix CVE-2026-73212?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-73212 being exploited?
There is no known exploitation of CVE-2026-73212 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-73212, GHSA-2x4g-wx24-48m4, UBUNTU-CVE-2026-73212.