CVE-2026-82476 Memos through 0.30.0 SSRF via Omitted CGNAT Address Range
Unauthenticated attackers can bypass SSRF protections to access internal cloud metadata services and read sensitive data via the link-metadata fetcher.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82476?
CVE-2026-82476 is a medium-severity server-side request forgery vulnerability in usememos memos, published on 29 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Memos through 0.30.0 omits the 100.64.0.0/10 carrier-grade NAT address range from SSRF protection in its link-metadata fetcher, allowing unauthenticated attackers to bypass IP validation. Attackers can make the server request internal hosts in that range including cloud metadata services and read page titles and descriptions back.
Weakness: CWE-918
Which versions are affected by CVE-2026-82476?
How do I fix CVE-2026-82476?
No fix has been published for CVE-2026-82476 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-82476 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82476 exists.
Sources
Also known as GHSA-rw55-gcm9-cgjp.